Information Security Analyst-2

Overview

Senior SOC Analyst role strengthening CorroHealth's Cyber Security Operations Center, focused on security monitoring, incident response, threat hunting and detection engineering across the enterprise.

What you'll do

• Monitor security alerts from CrowdStrike Falcon, NG-SIEM, Microsoft Defender, email security platforms and other security controls.
• Perform triage, analysis, containment, eradication and recovery for security incidents.
• Lead investigations involving malware, phishing, ransomware, insider threats and suspicious user activities.
• Conduct root cause analysis and document incident findings and recommendations.
• Coordinate with IT, Infrastructure, Cloud, Network and Business teams during incident response.
• Manage and optimize CrowdStrike Falcon EDR policies and detection configurations.
• Develop and fine-tune custom detection rules and alerting logic.
• Configure and manage CrowdStrike NG-SIEM data ingestion, use cases, dashboards and reporting.
• Perform endpoint threat analysis and remediation using Falcon Real-Time Response.
• Support deployment and maintenance of Falcon Data Protection, Identity Protection and Endpoint Security modules.
• Conduct proactive threat hunting using CrowdStrike Falcon, NG-SIEM and Defender telemetry.
• Identify indicators of compromise (IOCs), indicators of attack (IOAs) and anomalous behaviors.
• Develop detection content using CQL and KQL queries.
• Build and maintain threat hunting playbooks and investigation workflows.
• Research emerging threats, attacker techniques and industry threat intelligence.
• Investigate alerts from Microsoft Defender for Endpoint, Defender for Identity, Defender for Cloud Apps and Defender XDR.
• Perform advanced hunting using KQL, optimize Defender detection rules and reduce false positives.
• Correlate Defender telemetry with CrowdStrike and SIEM events.
• Manage and investigate alerts from Mimecast, Microsoft Defender for Office 365, Proofpoint or similar email security platforms.
• Analyze phishing, spoofing, malicious attachments and business email compromise (BEC) incidents.
• Develop email security monitoring and response procedures.
• Coordinate end-user awareness and phishing response activities.
• Develop SOC operational dashboards and security metrics.
• Create executive and management reports on threats, incidents and trends.
• Support audit, compliance and cyber risk assessment activities.
• Mentor junior SOC analysts and support skill development across the SOC team.

What you'll need

• Bachelor's degree in Computer Science, Information Security, Cybersecurity or related field.
• 5-8+ years of experience in Security Operations Center (SOC) or Cyber Defense environments.
• Minimum 2+ years of hands-on experience with CrowdStrike Falcon EDR.
• Experience working with CrowdStrike NG-SIEM.
• Experience with Microsoft Defender XDR ecosystem.
• Strong understanding of cybersecurity frameworks, attack techniques and threat intelligence.
• Experience in incident response and forensic investigations.
• Mandatory skills: CrowdStrike Falcon EDR, CrowdStrike NG-SIEM, CrowdStrike Query Language (CQL), Microsoft Defender XDR, Kusto Query Language (KQL), Threat Hunting, Incident Response, Endpoint Security, IOC/IOA Analysis, Email Security (Mimecast), SIEM Operations, Log Analysis, Malware Analysis, Security Investigations.

Nice to have

• Azure Security Controls, Network Security Monitoring, MITRE ATT&CK Framework, PowerShell scripting, Python scripting, SOAR platforms.
• Certifications: CrowdStrike Falcon Administrator, CrowdStrike Falcon Analyst, Microsoft SC-200 Security Operations Analyst, Microsoft SC-100 Cybersecurity Architect, GCIH, GCFA, CompTIA CySA+, CISSP.

Details

• Location: Noida, India (Luminaire).