Assoc. Dir. DDIT ISC CSOC Engineering - Cloud

Overview

Hands-on Cloud Detection Engineer role within Novartis Cyber Defense, building and improving cloud security monitoring across Azure, AWS and other strategic cloud platforms, working closely with incident response and cloud security architecture teams.

What you'll do

• Design and operate an AI-native cloud detection pipeline that aggregates, correlates, enriches, deduplicates and prioritizes signals before analyst investigation
• Build and tune high-fidelity detections across cloud control-plane, data plane and management-plane activity, identity and access, network, container and Kubernetes, and security posture
• Use lower-fidelity and behavioral signals as investigation context, while ensuring known high-confidence detections are consistently escalated for security investigation
• Integrate and correlate telemetry from WIZ, Microsoft Defender for Cloud, AWS GuardDuty, Microsoft Sentinel and other cloud-native or CNAPP sources
• Apply hands-on Wiz experience to interpret posture findings, attack paths, identity and exposure context, cloud events, runtime findings and threat detections, and improve detection workflows
• Develop behavioral baselines and entity-centric analytics across users, IP addresses, identities and cloud resources
• Create reusable dashboards, dynamic lookups and enrichment patterns enabling rapid pivots and drilldowns from an alert to related resource, identity, inventory and historical data
• Own the detection lifecycle from threat hypothesis and telemetry assessment through development, peer review, testing, deployment, tuning, documentation and retirement
• Embed AI across the detection lifecycle to accelerate detection creation and tuning, while ensuring engineering controls and human judgment govern the outcomes
• Finetune detections using historical data, controlled simulations, purple-team exercises, attack emulation and lessons learned from incidents and threat hunts
• Use detection-as-code practices, Git, CI/CD and automated testing to deliver controlled, repeatable and auditable content changes
• Partner with Threat Hunting and Response, CSOC analysts, cloud platform teams, data onboarding, threat intelligence and automation teams to close visibility gaps and operationalize detections
• Automate enrichment and triage using Python, APIs, SOAR workflows and AI-assisted approaches, with appropriate human oversight for security decisions
• Measure and improve detection coverage, precision, false-positive rate, investigation volume, alert latency, data quality and analyst effort

What you'll need

• 8+ years of hands-on experience in cloud security, detection engineering, security analytics, threat hunting, incident response or security platform engineering
• Working knowledge of Azure and AWS security architectures, respective cloud domains and workloads
• Understanding of cloud telemetry and logging sources such as Azure Activity and Diagnostic logs, Entra ID logs, AWS CloudTrail, AWS CloudWatch and GuardDuty findings
• Experience working with CNAPP bundles or developing and tuning detections in Wiz, Vega or cloud-native security platforms
• Proficiency in KQL and at least one scripting or programming language such as Python; CloudShell understanding is expected
• Familiarity with AI/LLM-assisted security investigation, agentic workflows or machine-learning approaches to signal enrichment and triage
• Understanding of MITRE ATT&CK, MITRE ATLAS, threat-informed defense, entity mapping, correlation, enrichment and alert prioritization
• Ability to investigate complex datasets, distinguish true security risk from operational noise and communicate engineering decisions clearly
• Experience collaborating across security operations, cloud engineering and platform teams in a global environment
• Experience with detection-as-code, Sigma or YAML-based content, Git, CI/CD, unit/integration testing and safe deployment or rollback practices
• Experience with Infrastructure as Code and automation tools such as Terraform, ARM/Bicep, CloudFormation or equivalent
• Background in threat intelligence, purple teaming, red teaming, incident response or cloud threat research

Nice to have

• Relevant certifications such as AZ-500, AWS Certified Security - Specialty, GIAC Cloud Security certifications, CCSP or equivalent practical expertise
• GIAC Cloud Forensics Responder (GCFR)

Details

• Location: Hyderabad (Office)