Associate, Security Operations Centre

Overview

Associate role in MassMutual's Cyber Fusion Center, a Security Operations Centre team within Enterprise Cyber Security, protecting company data, systems, employees, customers and policyowners.

What you'll do

• Monitor and investigate alerts across enterprise endpoints, networks, identity systems, email, applications, cloud platforms and SaaS services.
• Lead complex investigations by correlating SIEM, EDR/XDR, network, cloud, identity and threat-intelligence telemetry.
• Determine scope, impact, attack path and root cause; recommend and coordinate containment, eradication and recovery actions.
• Serve as an escalation point for analysts, provide technical guidance, and ensure high-quality case documentation and shift handoffs.
• Conduct proactive threat hunting using hypotheses, behavioral analytics, threat intelligence and the MITRE ATT&CK framework.
• Develop and tune detection logic, correlation rules, dashboards and response playbooks to improve coverage and reduce false positives.
• Identify opportunities for SOAR and agentic automation that improve response speed, consistency and analyst efficiency.
• Support malware triage and analysis; extract and operationalize indicators of compromise and attacker behaviors.
• Prepare concise incident updates, investigation reports, lessons learned and metrics for technical and leadership stakeholders.
• Partner with detection engineering, incident response, forensics, vulnerability management, cloud security and infrastructure teams to address control gaps.

What you'll need

• 5–8 years of progressive experience in security operations, incident response, threat detection, threat hunting, digital forensics, or a closely related discipline.
• Hands-on experience with an enterprise SIEM and EDR/XDR platform, including advanced querying, investigation and alert tuning.
• Strong understanding of Windows and Linux internals, networking, authentication, Active Directory or modern identity platforms, and common attacker techniques.
• Experience investigating threats across on-premises and cloud environments, including at least one major cloud platform.
• Working knowledge of phishing, credential abuse, malware, ransomware, lateral movement, persistence, data exfiltration and insider-risk scenarios.
• Ability to analyze logs, endpoint telemetry, network traffic and threat intelligence and convert findings into defensible response decisions.
• Automation or scripting capability using Python, PowerShell, SQL, KQL, SPL or a comparable query language.
• Strong written and verbal communication skills, including the ability to explain technical risk and business impact clearly.
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology or a related field, or equivalent practical experience.

Nice to have

• Experience with SOAR playbook development, detection-as-code, security data engineering, or applied AI/agentic capabilities in SOC workflows.
• Experience in a large, regulated, global enterprise or financial-services environment.
• Knowledge of NIST incident-response practices, cyber kill chain concepts and MITRE ATT&CK mapping.
• Relevant certifications such as CISSP, GIAC, SC-200, CompTIA CySA+, or equivalent technical credentials.
• Experience mentoring analysts, improving operational procedures, and contributing to purple-team or detection-validation exercises.

Details

• Location: Hyderabad, India.
• Participation in scheduled shift coverage, on-call support and critical-incident response as required, within a follow-the-sun global operating model.
• Specific location, work arrangement and shift schedule will be confirmed by the hiring team.