Sr Engineer II - SecOps Insider threat

Overview

Senior Security Analyst in the Security Operations Center (SOC), leading high-severity incident investigations and Tier 2 SOC operations, and mentoring analysts.

What you'll do

• Serve as incident lead for high-severity and complex security incidents from scope definition through containment, eradication and recovery.
• Assume responsibility for root-cause analysis.
• Lead complex, multi-stage investigations across endpoint, identity, network, cloud and SaaS telemetry, including advanced malware analysis, credential-compromise and lateral-movement investigations.
• Define detection strategy aligned to MITRE ATT&CK and the organization's threat model; identify and recommend new detection logic across SIEM, XDR, EDR and SOAR.
• Conduct threat hunts guided by threat intelligence, emerging TTPs and detection coverage gaps; convert findings into new detections, playbooks and control recommendations.
• Lead Tier 2 SOC operations, ensuring shift priorities, case load and blocking issue flow meet SLAs and quality standards.
• Build and maintain the SOC playbook, runbook and knowledge-based library.
• Identify, build and recommend SOC process improvements, measuring and reporting their impact.
• Help implement the multi-year security operations strategy, including detection coverage roadmap, telemetry strategy, automation targets and capability maturity.
• Interpret security findings as risk-centered advice for security engineering, IT and business collaborators.
• Mentor and develop Tier 1 and Tier 2 analysts through structured mentoring, investigation walkthroughs and technical training.
• Participate in cross-functional forums and collaborate with global security teams.
• Provide senior on-call coverage for major incidents involving blocking issues.

What you'll need

• 8+ years in security operations, incident response, detection engineering or an equivalent blue-team role.
• Bachelor's degree in Information Systems, Cybersecurity or a related field, or equivalent experience.
• Expert knowledge of Windows, Linux, Active Directory and Entra ID attack techniques; able to reconstruct an intrusion from raw logs without a playbook.
• Strong experience in cloud security monitoring and response across at least one major provider (AWS, Azure or GCP).
• Proficiency in Python or PowerShell for automation, data analysis and tooling integration.
• Deep understanding of MITRE ATT&CK, the incident response lifecycle, malware analysis and phishing investigation.
• Track record of defining standards, processes and playbooks, and improving them based on evidence.
• Demonstrated ability to mentor analysts and raise the technical bar of a team.
• Clear, structured technical writing, including incident reports, RCAs and briefings for senior technical and non-technical audiences.
• Strong influencing and teamwork skills; able to work with engineering, IT and business groups locally and globally without direct authority.

Nice to have

• Advanced certifications such as GCIA, GCIH, GCFA, GCDA, GNFA, GREM, OSCP, Microsoft SC-200 or equivalent.

Details

• Location: Gurugram, India.
• Compensation and benefits will be discussed during the recruitment process.