Security Operations Responder

Overview

Investigate and respond to security threats through Tide's security data lake and SOAR platform, while automating investigation work and improving detection efficacy within the Threat Detection & Response team.

What you'll do

• Actively triage and investigate security alerts and threats through the security data lake and SOAR platform, across AWS, GCP, SaaS (such as Google Workspace and Okta), internal applications and employee endpoints (Windows, macOS).
• Drive every investigation to a clear, well-evidenced outcome, establishing scope, impact and root cause, and taking containment and remediation actions quickly and confidently.
• Lead the response to complex or high-severity incidents where needed, coordinating across security, IT and engineering teams through containment, remediation and recovery.
• Document investigations clearly and consistently, and contribute to the runbooks and investigation standards the team works to.
• Reduce manual investigation by building SOAR playbooks, security automations and services, from data enrichment and context gathering through to automated response, such as removing phishing emails from employee mailboxes.
• Identify repetitive work in the queue and turn it into automated workflows.
• Identify gaps in log sources, parsing and enrichment in the data lake, and work to close them.
• Feed investigation outcomes back to the Detection Engineering team by flagging noisy rules, tuning false positives and highlighting coverage gaps to improve TP/FP efficacy.
• Track investigation metrics (such as MTTD, MTTR, TP/FP rate and automation coverage) and use them to prioritise improvements.
• Write, test and ship your own detections alongside Detection Engineering, following test-driven, detections-as-code practices.
• Proactively hunt for sophisticated threats across the infrastructure, using threat intelligence and lessons from past investigations.
• Build or enhance internal tools that streamline investigation, improve data visibility and increase response efficiency.
• Share knowledge and mentor other team members.

What you'll need

• Significant hands-on experience in security operations, incident response or threat investigation, ideally in a cloud-native environment.
• Strong investigative instincts and log analysis skills at scale, with the ability to query a security data lake or SIEM fluently.
• Strong knowledge of one of the following: Splunk, Scanner, Sentinel, SecOps.
• Strong understanding of modern attack and defence techniques applying to Cloud (AWS, GCP), SaaS (such as Google Workspace and Okta) and desktop (Windows and macOS) environments, and the ability to map activity to frameworks such as MITRE ATT&CK.
• Strong experience in security automation, from writing scripts (e.g. Python) to creating end-to-end automated workflows.
• Familiarity with SOAR platforms and automating investigation and response tasks.
• Experience writing or tuning detections, and a clear view of what separates a high-fidelity alert from a noisy one.
• Calm, methodical judgement during live incidents, including knowing when and how to escalate.
• An open mind and a curious approach.
• Hands-on attitude and the ability to drive solutions to completion.
• Passion for passing on knowledge to fellow colleagues.
• Excellent spoken and written communication skills, including clear investigation write-ups for both technical and non-technical audiences.

Nice to have

• A repository showcasing automations, detections or tooling you've built.

Details

• Location: Hyderabad, India.