Cyber Security Analyst

Hetero; Hyderabad; On-site; INR 180,000 - 240,000; Full time

Job summary

Hetero is seeking an experienced security professional to manage enterprise firewall and security operations. The role covers NGFW infrastructure, WAF deployment, 24x7 SOC monitoring, SIEM administration, vulnerability management, and incident response.

Collaboration with IT and security teams is essential to maintain compliance and risk posture. Responsibilities include designing firewall policies, managing VPNs and SD-WAN, reducing false positives, and leading incident reviews.

Qualifications

• Experience in managing enterprise NGFW infrastructure (Fortinet, Palo Alto, Check Point or equivalent).
• Ability to design and implement firewall policies, NAT/VIP, IPsec and SSL VPN, and SD-WAN.
• Experience in deploying and tuning WAF policies for internet-facing apps.
• Strong knowledge of OWASP Top 10 and web app security.
• Experience in 24x7 security monitoring and incident handling.
• Familiarity with vulnerability management tools (Tenable, Qualys).
• Experience in SIEM platforms and logging across environments.
• Knowledge of MITRE ATT&CK framework.

Responsibilities

• Own and operate NGFW infrastructure including high-availability clusters.
• Design, review and implement firewall policies and VPNs; manage SD-WAN.
• Deploy, tune and monitor WAF policies for internet-facing apps.
• Oversee 24x7 security monitoring; define escalation paths and runbooks.
• Coordinate NOC to SOC and cyber security escalation paths.
• Run vulnerability management and drive remediation with teams.
• Lead incident response to ransomware, phishing and data leakage events.
• Support governance, standards, and audits.

Skills

Firewall

WAF

SOC operations

SIEM

Vulnerability mgmt

Incident response

MITRE ATT&CK

IAM

Tools

Fortinet

FortiManager

Palo Alto

Check Point

Netskope

Ten able

Qualys

Splunk

Microsoft Sentinel

QRadar

FortiSIEM

Job description

Role & responsibilities

1. Firewall and network security

• Own enterprise NGFW infrastructure (Fortinet, Palo Alto, Check Point or equivalent), including HA clusters.
• Design, review and implement firewall policies, NAT/VIP, IPsec and SSL VPN, and SD-WAN.
• Run periodic rule-base reviews to remove unused, shadowed, risky and overly permissive rules.
• Maintain firmware, security patches and configuration backups under change control.
• Enforce segmentation across Internet, DMZ, data centre, branches and cloud.

2. Web Application Firewall (WAF)

• Deploy, tune and monitor WAF policies for all internet-facing applications.
• Defend against OWASP Top 10 attacks (SQL injection, XSS), bots, DDoS and application-layer abuse.
• Onboard new applications, manage TLS certificates and reduce false positives with application teams.
• Periodically review the external attack surface for exposed applications and services.

3. SOC (Security Operations Centre)

• Oversee 24x7 security monitoring with the in-house SOC or managed service provider.
• Define monitoring requirements, escalation paths, SLAs and playbooks.
• Review critical alerts and ensure thorough investigation and closure.
• Track and report security KPIs and KRIs such as MTTD and MTTR.

4. SIEM and security monitoring

• Administer SIEM platforms (Microsoft Sentinel, Splunk, QRadar, FortiSIEM or equivalent).
• Onboard log sources: firewalls, WAF, servers, endpoints, Active Directory, network devices, cloud and applications.
• Build and tune correlation rules and use cases mapped to MITRE ATT&CK.
• Maintain log retention, dashboards and management reports.

5. NOC and network operations

• Coordinate with the NOC on ISP/WAN links, VPN tunnels, device availability, latency and bandwidth.
• Establish a clear NOC to SOC to Cyber Security escalation path.
• Separate infrastructure incidents from security incidents and fix recurring root causes.

6. Vulnerability management

• Run vulnerability management using Tenable, Qualys or equivalent.
• Prioritize critical and high findings and drive remediation with server, endpoint and application teams.
• Track remediation SLAs, security exceptions and overall security posture.

7. Incident response

• Lead responses to ransomware, malware, phishing, account compromise, data leakage, web and network attacks.
• Maintain incident response plans and playbooks; coordinate forensics where needed.
• Run post-incident reviews and track corrective actions to closure.

8. Governance and compliance

• Maintain security policies, standards, SOPs and architecture documentation.
• Support ISO 27001, CERT-In, DPDP Act and other regulatory requirements.
• Maintain the security risk register and support internal and external audits.
• Evaluate security tools and manage vendors and implementation partners.

Preferred candidate profile

• 1. Firewall (Fortinet, Forti Manager Mandatory)
• 2. EDR and XDR
• 3. Proxy (Netskope)
• 4. WAF
• 5. IAM (Good to have)