Specialist - Information Security

Overview

Hybrid Information Security specialist role combining SOC alert monitoring and investigation with vulnerability assessment and penetration testing (VAPT) execution, plus evidence management.

What you'll do

• Monitor SOC queues and investigate alerts from Managed SOC/SIEM, endpoint, identity, email-security, DLP, VPN/proxy and endpoint-compliance sources.
• Enrich SOC alerts using user, device, IP, ASN, geo-location, application, timestamp, IOC, endpoint posture, related tickets and historical evidence.
• Document investigations with working notes, screenshots, containment status, closure rationale, ticket updates and shift handover notes.
• Execute scheduled and ad hoc vulnerability scans for infrastructure and applications; validate findings before escalation.
• Perform web application and API security testing under defined scope; mobile application testing is excluded unless separately assigned in the future.
• Review SAST/DAST findings, assist with secure-code review and coordinate with application/development owners for remediation evidence.
• Track vulnerability remediation and retesting in ServiceNow or approved workflow tools; maintain clean closure, retest and exception evidence.
• Support containment actions including account disablement, device freeze/quarantine/isolation, suspicious-session review, user outreach and restoration evidence.
• Prepare SOC monitoring inputs and VAPT status inputs including open vulnerabilities, overdue remediation, retest outcomes, repeat findings and escalation items.
• Provide security evidence from SOC/VAPT work when requested for audit/client/security review; do not own GRC program activities.
• Ensure SOC alerts are triaged consistently with evidence, classification, escalation notes and closure rationale.
• Validate, document and track infrastructure, web/API and SAST/DAST findings through remediation or retest.
• Escalate high-risk identity, endpoint, email, DLP, vulnerability and VPN/proxy events without delay.
• Maintain ServiceNow/security tickets that are complete, evidence-backed and aligned to SOC/VAPT operating expectations.

What you'll need

• Minimum 3-5 years of experience and working knowledge in SOC Operations: SOC, MDR, InfoSec operations, endpoint security, vulnerability management or security monitoring support.
• Ability to run vulnerability scans, validate vulnerabilities, capture evidence, prepare remediation notes and support retesting.
• Working knowledge of OWASP Top 10, web/API testing methodology and manual validation using Burp Suite or OWASP ZAP.
• Ability to review SAST/DAST tool findings, understand vulnerable code patterns and coordinate with developers under senior guidance.
• Clear business-formal writing for incident notes, vulnerability findings, remediation follow-ups and shift handovers; able to brief a Consultant/InfoSec lead with concise facts and risk indicators.
• SIEM/MDR tooling: Arctic Wolf/Aurora, Microsoft Sentinel or equivalent SIEM, Splunk/QRadar fundamentals, ServiceNow ticketing and IOC enrichment workflows.
• Identity/endpoint tooling: Microsoft Entra ID, Conditional Access, MFA, Defender for Endpoint, FortiEDR, Absolute, Intune/JamF, BitLocker/FileVault and endpoint evidence capture.
• Email/DLP tooling: Abnormal AI / O365 email security, Microsoft Purview DLP, phishing/BEC/ATO investigation queues and remediation evidence.
• Network vulnerability tools: Nessus, Qualys, OpenVAS, Nmap, basic Metasploit validation, Wireshark and SSL/TLS testing tools.
• Web/API testing tools: Burp Suite, OWASP ZAP, Postman, API collections and manual validation for authentication, authorization, session and input-handling issues.
• SAST tools: Checkmarx, Veracode, SonarQube, Fortify, Snyk, Semgrep or equivalent; ability to read code paths and identify likely vulnerable patterns.
• DAST tools: Burp Suite, OWASP ZAP, Acunetix, Invicti/Netsparker, AppScan or equivalent; validate output before raising remediation tickets.
• Connectivity context: FortiSASE, FortiGate, VPN, IPQS/IP2Proxy or equivalent tools for VPN/proxy/geolocation validation.

Nice to have

• BPO, healthcare, PCI or client-regulated environment exposure.
• Nessus/Qualys/OpenVAS and ServiceNow remediation tracking experience.
• Experience preparing concise technical finding write-ups.
• Familiarity with SonarQube, Snyk, Semgrep, Checkmarx, Veracode or Fortify.
• AD/Windows exposure awareness: BloodHound, PingCastle and NetExec/CrackMapExec awareness under supervision.
• Cloud security basics: Microsoft Defender for Cloud / Azure posture review, AWS exposure awareness, Prowler/ScoutSuite-style output interpretation.
• Certifications: eJPT / PNPT / CEH Practical, CompTIA PenTest+ / Security+ / CySA+, Burp Suite certification or web testing training, Splunk Core / SIEM fundamentals.

Details

• Hybrid scope balancing SOC alert response with VAPT execution within the same role.
• Mobile application testing is excluded unless separately assigned in the future.