Principal Analyst - SOC | On-site, Bangalore

Overview

Principal Analyst in a 24/7 Security Operations Center team, providing deep-level analysis for client investigations using customer-provided data sources, audit, and monitoring tools at government and enterprise levels.

What you'll do

• Operate independently in a geographically dispersed team, maintaining situational awareness and keeping the team up to date
• Perform security monitoring and incident response activities across networks, leveraging a variety of tools and techniques
• Detect incidents through proactive hunting across security-relevant data sets
• Thoroughly document incident response analysis activities
• Review investigations conducted by more junior analysts to ensure quality standards are met
• Develop new, repeatable methods for finding malicious activity across the networks
• Provide recommendations to enhance detection and protection capabilities
• Regularly present technical topics to technical and non-technical audiences
• Develop and follow detailed operational processes and procedures to analyze, escalate, and assist in remediation of information security incidents
• Prioritize multiple high-priority tasks and formulate responses and recommendations to customers and team members in a fast-paced environment
• Provide assistance to other security teams
• Continually develop new technical skills and push overall team capabilities forward
• Engage with and mentor other team members
• Work with other teams on major engineering and architecture initiatives
• Apply innovative understanding of attack methodologies, malware analysis, malicious toolkits, and how they manifest within various security technologies
• Perform advanced proactive threat hunting
• Apply advanced adversary emulation concepts
• Design advanced use cases for insider threat, operational, threat detection and response
• Review defensive and detective controls to reduce client attack surface

What you'll need

• 9+ years of hands-on cybersecurity operations experience across complex security investigations, incident response, threat hunting, detection engineering, and security control assessment in enterprise environments
• Experience in Cortex XSOAR, Proofpoint, Egress, MS Azure, MS Defender, Azure ADX, and Crowdstrike
• Advanced understanding of the cyber threat landscape and adversary TTPs, with extensive experience applying MITRE ATT&CK to investigations, threat hunting, detection engineering, adversary behavior analysis, and detection coverage assessment
• Lead complex, multi-source investigations using endpoint, network, identity, cloud, SaaS, memory, disk, and log evidence; preserve evidence, reconstruct attacker timelines, determine root cause and scope, and produce technically defensible findings
• Investigate identity- and cloud-centric attacks involving privileged accounts, federation, OAuth applications, tokens, service identities, control-plane/API activity, cloud workloads, SaaS audit records, and cross-account or cross-tenant access
• Demonstrated proficiency in SIEM, EDR/XDR, UEBA, and security data platforms, including developing and optimizing complex queries and correlating telemetry across endpoint, identity, cloud, SaaS, and network environments
• Use Python, PowerShell, or comparable scripting languages, REST APIs, and orchestration/SOAR platforms to automate enrichment, evidence collection, threat hunting, detection deployment, and repeatable response activities
• Own the detection lifecycle end-to-end, including requirements, data validation, use-case and rule development, peer review, testing, deployment, performance monitoring, tuning, documentation, and retirement, with analysis of both false positives and false negatives
• Design and execute hypothesis-driven and exploratory threat hunts based on adversary behavior, threat intelligence, MITRE ATT&CK coverage gaps, and incident learnings, converting validated findings into detections, analytics, or response content
• Assess telemetry quality and detection visibility, identify logging, ingestion, normalization, retention, and coverage gaps, and collaborate with engineering and architecture teams to improve monitoring and investigation capabilities
• Serve as technical lead for significant security incidents, defining investigative priorities, evidence-preservation requirements, scoping decisions, containment strategies, remediation validation, and technical handoffs while considering operational and business impact
• Demonstrate advanced endpoint and network investigation capabilities, including Windows/Linux security artifacts, EDR/XDR telemetry, packet captures, DNS, proxy, firewall, flow, and related data to identify command-and-control, lateral movement, persistence, exfiltration, and attacker infrastructure
• Operationalize threat intelligence by translating adversary TTPs, infrastructure, vulnerabilities, and campaign intelligence into prioritized hunts, behavioral analytics, detection logic, investigation guidance, and defensive-control improvements
• Perform advanced phishing and malware analysis, including malicious URLs, attachments, sender infrastructure, authentication artifacts, behavioral/static malware analysis, persistence, execution, and communications
• Provide Principal-level technical leadership, including reviewing complex investigations and detections for quality and accuracy, mentoring analysts, developing repeatable investigation and response methodologies, and collaborating with Security Engineering, Architecture, Threat Intelligence, Incident Response, Cloud, and Identity teams
• Strong analytical, problem-solving, documentation, and communication skills, with the ability to operate independently in a globally distributed environment and communicate complex technical findings to technical and non-technical stakeholders
• Excellent English fluency

Nice to have

• Advanced reverse engineering is not required

Details

• Work from Office position, on-site in Bangalore
• 24/7 support with rotational shifts across days, mids, and nights
• Shift flexibility is required