Assistant Manager - Cybersecurity Operations

Tata Communications Limited; Bengaluru; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Tata Communications Limited is seeking an experienced SOC Analyst to manage and analyze security incidents, lead investigations, and enhance detection using SIEM tools. The role demands hands-on experience with LogRhythm and Palo Alto XSIEM, threat intelligence, and malware analysis.

You will coordinate with L1 and L3 teams and ensure rapid containment and remediation in a 24/7 environment. Integrity, analytical skills, and the ability to document findings clearly are essential, along with a

Qualifications

• Graduate with 6-8 years of experience.
• Experience in SOC incident handling and incident response trend analysis.
• Experience in SIEM tools: Palo Alto XSIEM, LogRhythm.
• Ability to follow processes and guidelines.

Responsibilities

• Incident Handling and Analysis
• Take over prioritized alerts from L1 and perform detailed analysis
• Conduct deep-dive investigations using logs and threat intelligence
• Validate critical alerts true positive or false positive
• Identify attack patterns such as lateral movement, persistence, and privilege escalation
• Provide clear, actionable insights along with containment and remediation recommendations for critical alerts
• Investigation Evidence Management
• Provide audit-ready log evidence and maintain proper investigation artifacts
• Perform cross-correlation analysis (including advanced analytics like RhythmX in LogRhythm)
• Deliver detailed investigation reports with timelines and impact assessment
• Proactive Detection
• Perform IOC-based and deep-analysis using IOC/ pattern to detect anomalies
• Identify hidden or undetected threats beyond existing correlation rules and suggest L3 team on creation
• Recommend and implement new detection use cases and rule enhancements
• Use Case Tuning Optimization
• Fine-tune rules suggestion to L3 to reduce noise and improve detection efficiency
• Continuously improve alert accuracy by minimizing false positives and false negatives
• Log Source Platform Support
• Supporting log management activities including archival and restoration
• Work with L3 if needed to troubleshoot log ingestion issues (missing logs, delays, parsing failures)
• Ensure proper log normalization and data availability for analysis
• Incident Response Support (Critical Cases)
• Recommend and guide containment actions such as Blocking malicious IPs/domains; Isolating compromised endpoints; Disabling compromised user accounts
• Process Improvement Documentation
• Create and maintain playbooks, SOPs, and investigation procedures
• Ensure documentation is up to date for operational consistency
• Quality Assurance L1 Enablement
• Review and validate L1 escalations and tickets for accuracy and completeness
• Provide feedback and guidance to improve L1 monitoring and detection quality
• Collaboration Escalation Management
• Act as a bridge between L1 (monitoring team) and L3 (SME/support teams)
• Coordinate effectively for issue resolution, escalations, and platform improvements

Skills

SIEM Tool

Threat Intelligence

Malware Analysis

Incident Response

Threat Hunting

LogRhythm Admin

Education

BE/B.Tech or equivalent

Tools

Palo Alto XSIEM

LogRhythm SIEM

Job description

Broad outline of the Role

• The role is responsible for managing customer queries and operations. This is an operational role that may seek appropriate level of guidance and advice to ensure delivery of quality outcomes.
• Experience in SIEM Tool like Palo Alto XSIEM LogRhythm SIEM, Threat Intelligence, Malware Analysis, Incident Response
• Responsible for the technical Administration or troubleshooting in SIEM ensuring the efficient functionality of the solution
• Responsible for Incident Validation, Incident Analysis, Solution Recommendation,
• Good knowledge on implementation, installation, integration troubleshooting and overall functionalities of LogRhythm,
• LogRhythm rule base fine tuning, Ongoing log source modifications, Configuration/policy changes, General SIEM Administration, SIEM Content Development
• Troubleshooting of an incident within IT Security incident response teams of SOC.
• Apply investigation techniques to document root cause and impact of detected computer security incidents
• Maintains awareness of new and emerging cyber-attack threats with potential to harm company systems and networks. Devises and implements countermeasures to mitigate potential security threats.
• Assists with the development and maintenance of IT security measurement and reporting systems to aid in monitoring effectiveness of IT Security programs.
• Assists with the development, revision, and maintenance of Standard Operating Procedures and Working Instructions related to IT Security.
• Good Coordination skills with various other teams for faster resolution/completion.
• Good to have threat hunting knowledge.

Minimum Qualifications Experience

• Graduate with 6-8 years of experience

Other Knowledge Skills

• BE/B.Tech or equivalent with minimum 6-8 years of experience
• Work experience in SOC Incident Handling, Incident Response Trend Analysis, administration/monitroing of SIEM Tool like Palo Alto XSIEM, LogRhythm SIEM, Threat Intelligence, Malware Analysis,
• Ability to adapt and follow the processes and guidelines
• Possess an impeccable work ethic and a high degree of integrity
• Good Analytical Problem-Solving skills
• Able to communicate with technical staff/management
• Flexible to work in 24/7 environments
• Highly motivated customer centric
• Maintain awareness of latest technologies in the domain

Key Responsibilities

Incident Handling Analysis

Take over prioritized alerts from L1 and perform detailed analysis of suspicious or confirmed incidents

Conduct deep-dive investigations using logs, correlation rules, and threat intelligence

Validate critical alerts true positive or false positive

Identify attack patterns such as lateral movement, persistence, and privilege escalation

Provide clear, actionable insights along with containment and remediation recommendations for critical alerts

Investigation Evidence Management

Provide audit-ready log evidence and maintain proper investigation artifacts

Perform cross-correlation analysis (including advanced analytics like RhythmX in LogRhythm)

Deliver detailed investigation reports with timelines and impact assessment

Proactive Detection

Perform IOC-based and deep-analysis using IOC/ pattern to detect anomalies

Identify hidden or undetected threats beyond existing correlation rules and suggest L3 team on creation

Recommend and implement new detection use cases and rule enhancements

Use Case Tuning Optimization

Fine-tune rules suggestion to L3 to reduce noise and improve detection efficiency

Continuously improve alert accuracy by minimizing false positives and false negatives

Log Source Platform Support

Supporting log management activities including archival and restoration

Work with L3 if needed to troubleshoot log ingestion issues (missing logs, delays, parsing failures)

Ensure proper log normalization and data availability for analysis

Incident Response Support (Critical Cases)

Recommend and guide containment actions such as:

• Blocking malicious IPs/domains
• Isolating compromised endpoints
• Disabling compromised user accounts

Process Improvement Documentation

Create and maintain playbooks, SOPs, and investigation procedures

Ensure documentation is up to date for operational consistency

Quality Assurance L1 Enablement

Review and validate L1 escalations and tickets for accuracy and completeness

Provide feedback and guidance to improve L1 monitoring and detection quality

Collaboration Escalation Management

Act as a bridge between L1 (monitoring team) and L3 (SME/support teams)

Coordinate effectively for issue resolution, escalations, and platform improvements