Security Operations Centre (SOC) Analyst

 SOC analyst 

Location: Mumbai 

Experience: - 7 to 10 Years 

Band - 2B 

Role and Responsibilities: 

1. Develop, implement, and oversee the organization's comprehensive security strategy. 
2. Lead and mentor a team of security analysts to ensure high performance and professional growth. Act as a trusted advisor to executive leadership on security matters and emerging threats. 

• Threat Monitoring & Incident Response: 
• Oversee the detection and analysis of cybersecurity threats and vulnerabilities. 
• Manage the incident response process, ensuring timely identification, mitigation, and reporting of security incidents. 
• Collaborate with cross-functional teams to perform root cause analyses and implement corrective actions. 
• Risk Management & Compliance: 
• Conduct regular risk assessments and audits to ensure compliance with industry regulations and standards (e.g., ISO 27001, GDPR, SOC 2). 
• Implement and enforce policies, procedures, and controls to minimize risks and maintain compliance. 

1. Collaborate with legal and compliance teams to address security-related legal or regulatory requirements 

• Tools & Technology Management: 
• Evaluate, recommend, and implement security tools and technologies to strengthen defenses. 
• Oversee the configuration, maintenance, and monitoring of security infrastructure, including firewalls, SIEM systems, and endpoint protection tools. 
• Ensure the security of cloud platforms, networks, and on-premises systems. 
• Training & Awareness: 
• Develop and lead employee security awareness programs to promote a culture of security. 
• Stay current on emerging security trends and technologies to anticipate potential risks. 
• Vendor & Stakeholder Management: 
• Liaise with external vendors, consultants, and auditors to enhance security measures. 
• Build strong relationships with internal stakeholders to align security initiatives with business objectives. 

The Security Analyst assists the Data Security team to help ensure the security of the company and its clients. Looking for immediate joiners.

 KEY RESPONSIBILITIES

 All employees are expected to use good business judgment and appropriate discretion and decision making while performing responsibilities of the position, and to incorporate EVA’s Core Beliefs in their daily work.

• Performs daily health checks as documented by the IT Security team.
• Supports the Security team by documenting and performing support tasks.
• Participates in change management, incident management, audit and business continuity processes.
• Plans and implements security policies and procedures to protect computer systems, networks and data from unauthorized access.
• Participates in internal and external compliance (SOC 2) audits.
• Recommends security enhancements.

Job specifics:

• Familiarity with standard security concepts, practices and procedures.
• Knowledge of Windows operating systems.
• Strong Documentation, communication skills and attention to detail.
• Able to work independently and as a part of a team to deliver completed projects on-time.
• Identifies ways to continuously improve own and/or company performance.
• Knowledge of security toolsets
• Knowledge of compliance activities (GDPR, SOC 2, ISO:27001).
• Knowledge of database security.
• Knowledge of SIEM technology and security event correlation and monitoring.
• Experience with AWS.             
• Proficient with computer software including Salesforce 

 EDUCATION & EXPERIENCE  

• Bachelor’s Degree in computer science, mathematics, Information Systems or equivalent experience preferred.
• Minimum of 3 years of hands-on IT Security & Audit experience.
• Professional IT Security Certifications are strongly preferred, such as Security+, CISSP, CISM, CISA, GSEC, etc.

📢 We're Hiring | Cybersecurity Consultant | Gurugram

Role: Cybersecurity Consultant

Experience: 7+ Years

Location: Gurugram, Haryana

We are looking for experienced cybersecurity professionals with strong hands-on expertise in security operations, infrastructure security, vulnerability management and incident response.

🔹 Key Responsibilities

• Manage and strengthen security controls across enterprise IT infrastructure.
• Perform vulnerability assessments, remediation tracking and patch management.
• Monitor security alerts, investigate incidents and support threat hunting.
• Implement and manage SIEM, EDR and endpoint security solutions.
• Work on IAM controls, including MFA, SSO, RBAC and privileged access management.
• Support network security, including firewalls, IDS/IPS, segmentation and secure remote access.
• Assist with backup, recovery, disaster recovery and business continuity activities.
• Maintain security documentation, remediation evidence and audit compliance.

🔹 Required Skills

• 7+ years of relevant experience in cybersecurity, security engineering or security operations.
• Hands-on experience with SIEM tools such as Microsoft Sentinel, Splunk, QRadar or ArcSight.
• Knowledge of Microsoft security technologies, including Defender and Entra ID, is preferred.
• Experience with vulnerability management tools such as Tenable, Qualys or CrowdStrike Falcon.
• Strong understanding of incident response, threat hunting, network security and security remediation.
• Experience with EDR, IAM and enterprise security controls.

⭐ Preferred: OT/ICS security, IEC 62443, NIST frameworks, backup/DR and network segmentation experience.

📩 Interested candidates: Please share your updated cv at: snigdhaattheratebeanhr.com

Job Summary:

We are looking for an experienced OpenText ArcSight SIEM / SOAR / UBA L2-L3 Engineer to manage and support security platforms in SOC/MSSP environment. The role involves day-to-day administration, troubleshooting, configuration and optimization of ArcSight platforms.

Key Responsibilities

• Administer and monitor OpenText ArcSight ESM/SIEM, SmartConnectors, SOAR and UBA/ArcSight Intelligence.
• Manage SIEM rules, filters, Active Lists, dashboards, reports and correlation use cases.
• Monitor EPS, event flow, connector health, system performance and log ingestion.
• Troubleshoot event collection, parsing, correlation and integration issues.
• Configure and troubleshoot ArcSight SmartConnectors and log sources.
• Manage and troubleshoot SOAR playbooks, integrations and automated workflows.
• Support UBA/Intelligence data ingestion, analytics and integration with SIEM.
• Perform L2/L3 troubleshooting, RCA and resolution of platform-related incidents.
• Support upgrades, patches, configuration changes and platform optimization.
• Coordinate with SOC, infrastructure, customer and OEM/OpenText support teams.
• Maintain technical documentation, incident records and RCA reports.

Required Skills

• 3–6 years of hands-on experience with OpenText ArcSight SIEM/ESM.
• Strong experience in ArcSight administration and troubleshooting.
• Hands-on experience with SmartConnectors, EPS, correlation rules, Active Lists and event flow.
• Working experience with ArcSight SOAR and UBA/ArcSight Intelligence.
• Good knowledge of Linux/Unix and networking fundamentals.
• Understanding of Syslog, CEF, TCP/IP, SSL/TLS and REST APIs.
• Strong analytical, troubleshooting and problem-solving skills.
• Experience in SOC/MSSP or managed security services environment preferred.
• OpenText/ArcSight certification will be an added advantage.

Candidate Profile

The candidate should be hands-on, technically strong and capable of independently handling L2/L3 production issues, platform administration, troubleshooting and escalations in a security operations environment.

About the role

You will create and validate the detection content that protects our customers: IDPS signatures, application control rules, and DLP rules. This is a hands-on role in our security lab, where you will generate real attack traffic, research vulnerabilities and applications, and make sure every rule is accurate, effective, and ready for production.

What you'll do

Write security rules

• Write IDPS signatures for exploits, malware, command-and-control traffic, and network attacks, with the right severity, action (alert / block / reject), and protocol scope
• Build application control rules to identify and control social media, streaming, file sharing, remote access, unsanctioned SaaS, and AI tools
• Create DLP rules to detect sensitive data (personal and financial data, confidential documents, source code) across web, email, and file transfer channels

Test and validate

• Set up test scenarios in our lab and generate traffic using browsers, command-line tools, packet captures, and safe proof-of-concept exploits
• Confirm that each rule triggers and that logs show the correct rule, severity, action, and source
• Test against normal everyday traffic to find and fix false positives before rules ship
• Build and maintain a repeatable test set so rules keep working after product updates

Research and document

• Track new CVEs, exploit techniques, and emerging applications, and turn them into working detections
• Study public r
• Study public rulesets to learn coverage patterns and find gaps in our own
• Write a short validation note for each batch: what it detects, how it was tested, and what it doesn't cover

What we're looking for

• 2-5 years of hands-on experience writing detection rules or signatures with Snort, Suricata, Zeek, YARA, Sigma, or similar
• Strong networking fundamentals: TCP/IP, HTTP/HTTPS, DNS, TLS, and packet analysis with Wireshark or pcap tools
• Experience testing rules with PoC exploits and tuning them to reduce false positives
• Exposure to CVE and vulnerability research, with the ability to read advisories and turn them into detections
• Working knowledge of Python or Bash for test automation, and comfort with Linux
• Clear written communication, since you'll document what each rule covers and what it doesn't

Good to have

• Experience with deep packet inspection, application identification (nDPI or similar), or DLP regex and pattern work
• Background at a network security vendor (firewall, IPS, NGFW, secure web gateway)
• Public work such as GitHub rules, blog posts, CVE credits, or CTF participation

This role is not

A SOC monitoring, alert triage, or pure penetration testing role. We are looking for people who write and test detection rules.

Position Title: Network Operations Center (NOC) Analyst

Experience Required: 3+ Years

Working Mode: Remote

Preferred Location: Hyderabad / Bangalore / Chennai

Shift Timing: Rotational Shifts (US Timings)

About the Role

We are looking for a proactive and technically strong NOC Analyst to support MSP clients' enterprise network infrastructure. The ideal candidate should have hands-on experience in network monitoring, monitoring tool administration, incident management, basic network troubleshooting, documentation, and coordination with ISP, Field Engineers, and customers while ensuring maximum network availability and SLA compliance.

Mandatory Requirements

·       Strong communication skills with customers and technical teams.

·       Minimum 3+ years of experience in Enterprise NOC / Network Operations.

·       Experience working in 24×7 rotational shift environments.

·       Good understanding of Enterprise Network Monitoring and ITIL-based Incident Management.

·       MSP environment experience.&ITIL Foundation certification.

·       Exposure to AWS/Azure networking is an added advantage.

·       Valid CCNA Certification.( Preferred )

Technical Skills Required

Networking: TCP/IP, DNS, DHCP, Subnetting, IPv4 Addressing, LAN/WAN, VPN

Routing & Switching: Basic troubleshooting of OSPF, BGP; good understanding of VLAN, STP and Trunking

Monitoring Protocols: SNMP, Syslog, NetFlow, Telemetry

Monitoring Tools: SolarWinds, LogicMonitor, Auvik, PRTG, Zabbix, Nagios, ManageEngine

Ticketing Tools: ServiceNow, ConnectWise, Jira, Zendesk

Basic Knowledge: Windows Server, Linux, Network Devices, Firewall Concepts

Key Responsibilities

Network Monitoring

·       Monitor enterprise network infrastructure using monitoring platforms.

·       Integrate and onboard new network devices/nodes into monitoring tools.

·       Configure and maintain monitoring templates, thresholds, and alert profiles.

·       Ensure continuous availability of monitored infrastructure.

Incident Management

·       Monitor alerts and incidents generated from monitoring platforms.

·       Perform ticket triaging, categorization and prioritization.

·       Perform Level-1 and basic Level-2 network troubleshooting.

·       Escalate incidents appropriately and ensure SLA compliance.

Network Troubleshooting

·       Basic troubleshooting of OSPF, BGP, Routing & Switching.

·       Troubleshoot DNS, DHCP, TCP/IP, LAN/WAN, VPN and network reachability.

·       Perform subnet calculations and IP addressing validation.

Monitoring Protocols

·       Hands-on knowledge of SNMP, Syslog, NetFlow and Telemetry.

·       Understand device discovery, performance monitoring, fault monitoring and alert generation.

Coordination & Documentation

·       Coordinate with Field Engineers, ISP providers, Client Technical Teams and internal L2/L3 teams.

·       Track incidents until complete resolution.

·       Prepare RCA, SOP, Incident Reports, Shift Handover Documents, Knowledge Base Articles and Weekly/Monthly Operational Reports.

Educational Qualification

Bachelor's Degree in Computer Science, Information Technology, Electronics, or a related field.

Notice Period

Immediate Joiners / Short Notice Candidates Preferred.

Job Title : L2 Operations Lead – Malware Tools

Experience : 10+ Years

Location : Gurugram

Work Mode : Hybrid – 2 Days in Office

Employment Type : Full-Time

Engagement Duration : 6+ Months

Number of Positions : 1

Support Level : L2 Operations

Domain : Endpoint Security & Malware Protection

About the Role :

We are looking for an experienced L2 Operations Lead – Malware Tools to manage and support enterprise endpoint protection and malware security platforms, with a primary focus on CrowdStrike. The ideal candidate will have strong expertise in endpoint detection and response (EDR), malware investigation, incident management, and endpoint security operations.

The role involves monitoring security platforms in a 24×7×365 support environment, resolving Level 2 incidents, troubleshooting endpoint security agents, and escalating complex issues to L3 teams when required. The candidate will also collaborate with cross-functional security and infrastructure teams to maintain effective endpoint protection and minimize recurring incidents.

Mandatory Skills :

CrowdStrike Falcon, EDR, Endpoint Security, Malware Detection & Investigation, Alert Triage, Threat Containment, Microsoft Defender, ServiceNow, SIEM/SOAR (Splunk), Windows Server, Incident Management, 24×7 Operations Support, and Python/PowerShell Scripting.

Key Responsibilities :

• Manage end-to-end security incident handling, from L1/L1.5 escalation through investigation, resolution, and closure.
• Monitor and support endpoint protection and malware security platforms in a 24×7×365 operational environment.
• Administer and maintain CrowdStrike Falcon and other endpoint detection and response (EDR) solutions.
• Investigate malware alerts, perform alert triage, assess risks, and implement appropriate containment and remediation actions.
• Troubleshoot endpoint security agent issues, including installation, deployment, connectivity, health monitoring, and performance.
• Install, configure, update, and maintain antivirus and endpoint protection solutions across servers.
• Manage endpoint security consoles, agent updates, patching, platform upgrades, and configuration changes.
• Escalate complex incidents to L3 teams with detailed investigation findings, impact assessments, and recommended actions.
• Maintain accurate and up-to-date incident records in ServiceNow, including investigation details, resolution steps, and closure notes.
• Participate in Root Cause Analysis (RCA) reviews and implement corrective and preventive measures.
• Develop and maintain Standard Operating Procedures (SOPs), troubleshooting guides, and knowledge-base articles.
• Analyze incident trends and recurring alerts to improve detection effectiveness and reduce repeated incidents.
• Collaborate with DLP, Hosting, Network Security, Identity and Access Management (IDAM), and other infrastructure teams to resolve cross-functional issues.
• Ensure compliance with client security policies, operational procedures, and established service-level agreements (SLAs).
• Provide clear incident updates, communicate security risks promptly, and recommend appropriate mitigation measures.

Required Technical Skills :

• Endpoint Security & EDR : Strong hands-on experience with endpoint protection, antivirus, and EDR technologies.
• CrowdStrike Falcon : Experience in administration, monitoring, policy management, alert investigation, and agent troubleshooting.
• Microsoft Defender : Knowledge of endpoint protection and malware detection capabilities.
• Malware Investigation : Expertise in alert triage, threat analysis, risk assessment, containment, and remediation.
• ITSM : Experience with incident, problem, and change management processes.
• Security Monitoring : Familiarity with SIEM/SOAR platforms and security event analysis.
• Operating Systems : Strong knowledge of Windows operating systems and endpoint security administration.
• Scripting : Basic to intermediate scripting knowledge in Python or PowerShell for troubleshooting and operational automation.
• Monitoring Tools : Familiarity with Splunk, DataDog, and related monitoring or security operations tools.

Tools & Technologies :

• CrowdStrike Falcon
• Microsoft Defender
• ServiceNow
• Splunk SIEM
• SOAR Platforms
• DataDog
• Antivirus and Endpoint Detection & Response (EDR) Solutions
• Windows Server and Windows Operating Systems
• Python / PowerShell

Required Experience & Qualifications :

• 10+ years of overall experience in IT operations, endpoint security, or related security operations functions, with strong hands-on L2 endpoint security experience.
• Proven experience supporting endpoint protection and malware security tools in an enterprise environment.
• Hands-on experience with CrowdStrike Falcon or other enterprise EDR solutions.
• Experience troubleshooting endpoint security agents and resolving security incidents.
• Strong understanding of malware investigation, alert triage, threat containment, and escalation procedures.
• Experience working in a 24×7 operational support environment.
• Good understanding of ITSM processes, including incident, problem, and change management.
• Experience maintaining operational documentation, SOPs, RCA reports, and knowledge-base articles.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent written and verbal English communication skills.
• Ability to coordinate effectively with L1, L3, and cross-functional infrastructure and security teams.

Preferred Certifications :

• CrowdStrike Falcon Administrator
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• CompTIA Security+

Key Performance Expectations :

• Timely resolution of L2 incidents within defined SLAs.
• Effective investigation and containment of malware and endpoint security threats.
• Reduced recurrence of incidents through RCA and preventive actions.
• Accurate incident documentation and timely escalations.
• Improved endpoint agent health, security coverage, and operational efficiency.
• Compliance with client security standards and operational procedures.

Ideal Candidate Profile :

The ideal candidate is a hands-on endpoint security professional with extensive L2 operations experience, strong CrowdStrike or EDR expertise, and the ability to independently manage security incidents in an enterprise environment. The candidate should demonstrate sound troubleshooting skills, effective incident coordination, and a proactive approach to improving security operations.

L2 Production Support, Event Management / Mission Control, Incident Management, Linux, Linux, observability, and batch monitoring

At Shipthis, we are building a better future for freight forwarders by evolving traditional operations into fully digital, efficient, and scalable systems. We’re a fast-growing product company where every individual has the opportunity to take ownership, move fast, and create real impact. If you enjoy solving complex problems, shaping products from the ground up, and influencing technical direction, Shipthis is the place for you.

Learn more at www.shipthis.co

Role Overview

We are looking for an associate-level SecOps Engineer to support security operations, compliance, endpoint management, cloud infrastructure, and DevOps engineering. The role will work closely with the CTO/CISO and engineering team. Security and compliance are core responsibilities; when those priorities are lighter, the engineer will focus on CI/CD, infrastructure automation, reliability, monitoring, performance, and cloud cost optimization.

What You’ll be Doing

Security Operations

• Monitor infrastructure, application, and security alerts and assist with incident investigation.
• Review access controls, privileged accounts, service accounts, permissions, and periodic access reviews.
• Support infrastructure hardening, logging, monitoring, backup, recovery, and other security controls.
• Track security issues and corrective actions through closure.

Vulnerability Management

• Run and review application and infrastructure vulnerability scans.
• Maintain a vulnerability register and coordinate remediation with engineering teams.
• Support VAPT and penetration-testing exercises and validate closure of findings.
• Monitor dependencies, containers, operating systems, and cloud infrastructure for known vulnerabilities and patching needs.

Compliance & Governance

• Support ongoing ISO/IEC 27001, SOC 2, GDPR, customer-security, and internal-policy requirements.
• Maintain audit evidence, control registers, security policies, procedures, risk items, and remediation records.
• Assist with internal/external audits, vendor assessments, customer security questionnaires, and asset inventories.
• Maintain evidence for access reviews, vulnerability management, incidents, onboarding/offboarding, backups, and infrastructure changes.

MDM & Endpoint Security

• Administer the company MDM platform and enroll/manage company laptops, desktops, and mobile devices.
• Maintain device inventory and monitor endpoint compliance.
• Enforce approved controls such as disk encryption, screen locks, password requirements, patching, and endpoint protection.
• Support employee device onboarding/offboarding, approved application deployment, lost/stolen-device procedures, and remote wipe where authorized.
• Maintain endpoint security and MDM evidence required for audits and troubleshoot enrollment or policy issues.

DevOps, CI/CD & Cloud

• Maintain and improve CI/CD pipelines, deployment workflows, build times, caching, and rollback processes.
• Support production and non-production cloud infrastructure, networking, DNS, TLS certificates, IAM, and secrets.
• Automate repetitive deployment, infrastructure, security, and compliance tasks.
• Improve monitoring, logging, alerting, reliability, resource utilization, and cloud costs.
• Troubleshoot pipeline, deployment, and infrastructure issues and participate in root-cause analysis.

Required Fundamentals

• Basic knowledge of Linux, networking, HTTP/HTTPS, DNS, TLS, Git, Docker, cloud computing, APIs, and web applications.
• Understanding of IAM, MFA, least privilege, vulnerabilities/CVEs, encryption, logging, patching, and secrets management.
• Strong troubleshooting, ownership, attention to detail, and willingness to learn.

Desired Qualifications

• 1–2 years of experience with strong fundamentals are welcome.
• Basic scripting knowledge in Python, Bash, or similar.
• Interest in cybersecurity, cloud infrastructure, automation, and troubleshooting.
• Exposure to AWS/GCP/Azure, Terraform, GitHub Actions, Cloudflare, OWASP, vulnerability scanners, MDM, ISO 27001, or SOC 2 is a plus, not mandatory.

We Welcome Candidates:

• Who can join immediately
• Female candidates returning to work after a career break are strongly encouraged.

We are an equal opportunity employer and are committed to fostering diversity and inclusivity. We do not discriminate based on race, religion, color, gender, sexual orientation, age, marital status, or disability status.

Job Synopsys

Location: Bangalore

Job Type: Full-time, Permanent

Experience: 1-2 years

Industry: Software Product