Job Title:

Specialist II, Security Incident Response Team (TCF)

Job Description

Job Description Summary
We are seeking a highly skilled SOC Lead to oversee our MSS SOC, drive threat detection, and orchestrate incident response. This role demands deep technical expertise, strong leadership, and the ability to design and implement advanced security monitoring and response strategies.

The SOC Lead will be responsible for real-time monitoring, threat intelligence analysis, forensic investigations, and security automation, ensuring that the organization remains resilient against evolving cyber threats.

SOC Operations & Security Monitoring

Lead and manage the 24/7 Security Operations Center (SOC), ensuring continuous threat detection and response.Working extensively on SIEM (XSIAM. Arcsight, Splunk, QRadar, ELK, Sentinel, etc.) and other security monitoring tools.Oversee 24/7 monitoring of security events and alerts.Ensure effective use of SIEM (Security Information and Event Management) tools.Prioritize, analyze, and manage security incidents.Improve threat intelligence capabilities and integrate with threat intelligence feeds.Continuously optimize detection rules, correlation logic, and security alerts to minimize false positives and improve response times.

Incident Response & Management

Develop and enforce incident response plans (IRPs).Ensure timely response to cyber threats, minimizing impact.Coordinate with stakeholders during major incidents.Conduct post-incident analysis and lessons learned exercises.

EDR/XDR (Endpoint Detection & Response / Extended Detection & Response)

CrowdStrike Falcon – AI-powered threat detection with real-time response.Palo Alto XDR – Extended Detection and Response.Microsoft Defender for Endpoint – Integrated with Azure security solutions.– Behavioral AI-driven endpoint protection.Carbon Black (VMware) – Next-gen EDR with cloud analytics.Sophos Intercept X – Machine-learning-based ransomware prevention.

Threat Intelligence Platforms (TIP)

Recorded Future – AI-driven threat intelligence analysis.MISP (Malware Information Sharing Platform) – Open-source threat sharing platform.Flashpoint Threat IntelOutseer AFCC ( Previously RSA) IBM X-Force Exchange – Intelligence-sharing with global threat data.Anomali ThreatStream – Automated threat intelligence processing.VirusTotal Enterprise – File and URL malware scanning with shared intelligence.

Required Technical Skills & Experience:

Experience: 3+ years in cybersecuritySIEM & Log Analytics: XSIAM, ArcSight, Splunk, Elastic Stack (ELK), QRadar, Microsoft SentinelThreat Intelligence: MITRE ATT&CK, Cyber Kill Chain, MISP, STIX/TAXII.Incident Response & Forensics: Volatility, Wireshark, FTK, EnCase, Sleuth Kit, YARA.Endpoint Security & EDR/XDR: CrowdStrike Falcon, Microsoft Defender, Palo Alto XDR, SentinelOne, Carbon Black.Cloud Security: AWS GuardDuty, Azure Security Center, Google Chronicle, CSPM, CNAPP.Compliance & Risk: NIST 800-53, ISO 27001, PCI-DSS, SOC2, GDPR, CIS Benchmarks.

Location:

IND Gurgaon - Bld 14 IT SEZ Unit 1, 17th C & D and Gd Flr D

Language Requirements:

Time Type:

Full time

If you are a California resident, by submitting your information, you acknowledge that you have read and have access to the Job Applicant Privacy Notice for California Residents