Associate SOC

Tekion

Bengaluru

On-site

INR 1,200,000 - 1,800,000

Full time

6 days ago

Be an early applicant

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Benefits offered by this job

Opportunity to work with some of the智?

Impactful role in shaping and securing

Innovative, collaborative, and fast‑pA

Job summary

Tekion in Bengaluru, India is seeking a Security Threat Detection Engineer II to join the 24x7 Security Operations Center. You will monitor, triage, and respond to alerts, tune detections, and help strengthen the security posture across cloud, network, and endpoints.

The role emphasizes malware analysis, threat hunting, and building automation with AI agents and SOAR playbooks, while tracking SOC metrics and collaborating with IT and engineering teams.

Qualifications

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or related field.
4-6 years of experience in security operations, security engineering, incident response, or related roles.
Willingness and ability to work in a 24x7 SOC on a rotating shift schedule, including night shifts, weekends, and holidays.
Hands-on experience with alert triage, investigation, and incident response in a SOC environment.
Experience building and tuning detections in SIEM/EDR platforms and reducing false positives; familiarity with MITRE ATT&CK.
Experience conducting threat hunts using endpoint, network, cloud, and identity telemetry, and translating findings into detections.
Experience with malware analysis, including static and dynamic analysis, sandboxing tools, and IOC extraction; familiarity with tools such as sandbox environments, YARA, or disassemblers/debuggers is a plus.
Experience with SOAR platforms and building automated playbooks; exposure to AI agents or LLM-based automation for security operations strongly preferred.
Strong understanding of network, application, and cloud security principles.
Experience with security tools such as SIEM, EDR, IDS/IPS, vulnerability scanners, and endpoint protection.
Knowledge of cloud platforms (AWS, GCP, Azure) and their security services and logging.
Familiarity with compliance and security frameworks (NIST, ISO 27001, SOC 2, CIS).
Scripting or automation experience (Python, Bash, or equivalent) preferred.
Experience defining and reporting operational security metrics (MTTD, MTTR, false positive rates) preferred.
Strong analytical and problem-solving skills.
Good written and verbal communication abilities, including clear documentation and shift handoffs.
Industry certifications such as CISSP, GCIH, GCIA, GCFA, GREM, GCTI, or CEH preferred.

Responsibilities

Work in a 24x7 SOC environment on a rotating shift schedule, including night shifts, weekends, and holidays, providing continuous alert monitoring and response coverage.
Triage, investigate, and respond to security alerts from SIEM, EDR, cloud, network, and identity sources; escalates confirmed incidents per established procedures.
Continuously tune detections and alert logic to reduce false positives and improve signal-to-noise ratio across the alert pipeline.
Build, test, and maintain detection rules and use cases aligned to frameworks such as MITRE ATT&CK, based on emerging threats and gaps identified during investigations.
Conduct proactive, hypothesis-driven threat hunts across endpoint, network, cloud, and identity telemetry to uncover threats that evade existing detections, and convert hunt findings into new detection rules.
Perform malware analysis (static and dynamic/sandbox-based) on suspicious files, scripts, and artifacts to determine behavior, extract indicators of compromise (IOCs), and inform containment, detection, and response actions.
Design, build, and maintain automation using AI agents and SOAR workflows/playbooks to accelerate alert triage, enrichment, containment, and response.
Define, track, and report SOC metrics (e.g., MTTD, MTTR, alert volume, false positive rates, automation coverage) to measure and improve SOC effectiveness.
Participate in incident detection, response, containment, and root cause analysis, including post-incident reviews and lessons learned.
Implement, configure, and maintain security tools, monitoring systems, and access controls that support SOC operations.
Support vulnerability management, including scanning, analysis, and remediation coordination.
Collaborate with Engineering and IT teams to embed security best practices and improve telemetry, logging, and detection coverage.
Assist in maintaining compliance with security standards and regulatory requirements (e.g., SOC 2, ISO 27001, NIST).
Contribute to threat modeling and risk assessments for new projects and technologies.
Create and maintain security documentation, runbooks, playbooks, and knowledge bases to support consistent shift handoffs and response quality.
Provide guidance and mentorship to junior engineers and analysts, including during shift operations.
Stay current on emerging security threats, detection techniques, AI-driven security tooling, and technologies.

Skills

SOC operations

Alert triage

Threat hunting

Malware analysis

Automation / SOAR

MITRE ATT&CK

SIEM / EDR

Cloud security

Python / Bash

Documentation & communication

Education

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or related field

Tools

YARA

Sandboxing tools

Job description

Role & responsibilities

The Security Threat Detection Engineer II (SOC) is a hands-on member of the company's 24x7 Security Operations Center, responsible for monitoring, triaging, and responding to security alerts across the company's technology environment. This role operates on a rotating shift schedule, including night shifts, weekends, and holidays, to ensure continuous security coverage. A major focus of this role is responding to and investigating security alerts, reducing false positives through detection tuning, building and improving detection rules, conducting proactive threat hunting, performing malware analysis to support investigations, tracking and reporting SOC metrics, and automating response workflows using AI agents and SOAR platforms. The Engineer II works on moderately complex projects with minimal supervision and partners with IT, Engineering, and Security Operations to identify risks, remediate vulnerabilities, and strengthen overall security posture.

Key Roles & Responsibilities

Work in a 24x7 SOC environment on a rotating shift schedule, including night shifts, weekends, and holidays, providing continuous alert monitoring and response coverage.

Triage, investigate, and respond to security alerts from SIEM, EDR, cloud, network, and identity sources; escalates confirmed incidents per established procedures.

Continuously tune detections and alert logic to reduce false positives and improve signal-to-noise ratio across the alert pipeline.

Build, test, and maintain detection rules and use cases aligned to frameworks such as MITRE ATT&CK, based on emerging threats and gaps identified during investigations.

Conduct proactive, hypothesis-driven threat hunts across endpoint, network, cloud, and identity telemetry to uncover threats that evade existing detections, and convert hunt findings into new detection rules.

Perform malware analysis (static and dynamic/sandbox-based) on suspicious files, scripts, and artifacts to determine behavior, extract indicators of compromise (IOCs), and inform containment, detection, and response actions.

Design, build, and maintain automation using AI agents and SOAR workflows/playbooks to accelerate alert triage, enrichment, containment, and response.

Define, track, and report SOC metrics (e.g., MTTD, MTTR, alert volume, false positive rates, automation coverage) to measure and improve SOC effectiveness.

Participate in incident detection, response, containment, and root cause analysis, including post-incident reviews and lessons learned.

Implement, configure, and maintain security tools, monitoring systems, and access controls that support SOC operations.

Support vulnerability management, including scanning, analysis, and remediation coordination.

Collaborate with Engineering and IT teams to embed security best practices and improve telemetry, logging, and detection coverage.

Assist in maintaining compliance with security standards and regulatory requirements (e.g., SOC 2, ISO 27001, NIST).

Contribute to threat modeling and risk assessments for new projects and technologies.

Create and maintain security documentation, runbooks, playbooks, and knowledge bases to support consistent shift handoffs and response quality.

Provide guidance and mentorship to junior engineers and analysts, including during shift operations.

Stay current on emerging security threats, detection techniques, AI-driven security tooling, and technologies.

Basic Qualifications

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or related field; equivalent experience considered.

46 years of experience in security operations, security engineering, incident response, or related roles.

Willingness and ability to work in a 24x7 SOC on a rotating shift schedule, including night shifts, weekends, and holidays.

Hands-on experience with alert triage, investigation, and incident response in a SOC environment.

Experience building and tuning detections in SIEM/EDR platforms and reducing false positives; familiarity with MITRE ATT&CK.

Experience conducting threat hunts using endpoint, network, cloud, and identity telemetry, and translating findings into detections.

Experience with malware analysis, including static and dynamic analysis, sandboxing tools, and IOC extraction; familiarity with tools such as sandbox environments, YARA, or disassemblers/debuggers is a plus.

Experience with SOAR platforms and building automated playbooks; exposure to AI agents or LLM-based automation for security operations strongly preferred.