Cyber Security Threat Hunter - L3

SHI; Hyderabad; On-site; INR 400,000 - 700,000; Full time

Job summary

SHI in Hyderabad seeks an experienced SOC Lead / Threat Hunter to drive global SOC operations, SIEM management, and proactive threat hunting. You will lead incident investigations, optimize SOC platforms, and coordinate with regulatory bodies as needed.

The role emphasizes vulnerability management, digital forensics, and integration of SIEM, SOAR, XDR, UEBA, and threat intelligence feeds. Strong analytical and communication skills are essential.

Qualifications

• 810 years of experience in a Global Security Operations Center (SOC) environment.
• Hands-on experience with SIEM tools such as Splunk, QRadar, or HP ArcSight.
• Experience in triage and incident analysis – ability to quickly separate true threats from false positives.
• Strong expertise with vulnerability management tools such as Tenable, Rapid7, Qualys, Nmap, Burp Suite, etc.
• Experience conducting Vulnerability Assessment & Penetration Testing (VA/PT) for infrastructure and web applications.
• Knowledge of behavioral anomaly detection and emerging threat identification.
• Experience with digital forensics investigations, incident containment, and mitigation.
• Strong understanding of MITRE ATT&CK framework, Cyber Kill Chain, and proactive threat hunting methodologies.
• Ability to analyze and correlate network, firewall, proxy, and application logs.
• Strong knowledge of networking and security infrastructure including routers, switches, firewalls, and endpoint security.
• Experience working with SOAR, XDR, IDS/IPS, UEBA, and threat intelligence tools.

Responsibilities

• Security Monitoring & Threat Detection: Monitor platforms, APIs, and gateways for anomalies, vulnerabilities, and misconfigurations.
• Support and maintain UAT and Production SIEM environments across DC/DR locations.
• Continuously monitor threats using SIEM, network telemetry, and log analytics.
• Integrate and manage SIEM, SOAR, XDR, IDS/IPS, UEBA, and threat intelligence feeds for visibility.
• Threat Intelligence & Incident Response: Track zero-day threats and lead incident triage, containment, and recovery.
• Conduct root cause analysis and post-incident reviews.
• Coordinate incidents with regulatory bodies when required.
• Perform red team / blue team exercises and cyber drills.
• SOC Operations & Platform Optimization: Manage SOC tools, dashboards, and analytics engines.
• Implement automation through SOAR playbooks and ML-based anomaly detection.
• Collaborate with IT/operations to strengthen enterprise resilience and ensure log retention.
• Forensic readiness and policy development: maintain forensic readiness, log management, and SOC policies.

Skills

Threat hunting

Incident investigations

Analytical skills

Communication

Log analysis

Education

ITIL

CCNA

CEH

Tools

Splunk

QRadar

HP ArcSight

Tenable

Rapid7

Qualys

Nmap

Burp Suite

SOAR

XDR

IDS/IPS

UEBA

Threat intelligence feeds

Job description

SOC Threat Hunter

Level : L3

Location: Hyderabad

Experience: 810 Years

We are looking for an experienced SOC Lead / Threat Hunter with strong expertise in Global SOC operations, SIEM management, and advanced threat hunting. The candidate will be responsible for leading incident investigations, optimizing SOC platforms, and proactively identifying emerging cyber threats.

Key Requirements

• 810 years of experience working in a Global Security Operations Center (SOC) environment.
• Hands-on experience with SIEM tools such as Splunk, QRadar, or HP ArcSight.
• Experience in triage and incident analysis – ability to quickly separate true threats from false positives.
• Strong expertise with vulnerability management tools such as Tenable, Rapid7, Qualys, Nmap, Burp Suite, etc.
• Experience conducting Vulnerability Assessment & Penetration Testing (VA/PT) for infrastructure and web applications.
• Knowledge of behavioral anomaly detection and emerging threat identification.
• Experience with digital forensics investigations, incident containment, and mitigation.
• Strong understanding of MITRE ATT&CK framework, Cyber Kill Chain, and proactive threat hunting methodologies.
• Ability to analyze and correlate network, firewall, proxy, and application logs.
• Strong knowledge of networking and security infrastructure including routers, switches, firewalls, and endpoint security.
• Experience working with SOAR, XDR, IDS/IPS, UEBA, and threat intelligence tools.
• Strong analytical, investigation, and communication skills.

Preferred Certifications: ITIL, CCNA, CEH, or other cybersecurity certifications.

Key Responsibilities

1. Security Monitoring & Threat Detection

• Monitor trading and clearing platforms, APIs, and connectivity gateways for anomalies, vulnerabilities, and misconfigurations.
• Support and maintain UAT and Production SIEM environments across DC/DR locations.
• Continuously monitor threats using SIEM, network telemetry, behavioral analytics, and log intelligence.
• Integrate and manage SIEM, SOAR, XDR, IDS/IPS, UEBA, and threat intelligence feeds for complete visibility.

2. Threat Intelligence & Incident Response

• Track zero-day vulnerabilities, advanced persistent threats (APT), and cyber threats targeting financial markets.
• Lead incident triage, investigation, containment, eradication, and recovery activities.
• Conduct root cause analysis and post-incident reviews.
• Coordinate critical incidents with regulatory bodies such as SEBI, CERT-In, and RBI when required.
• Conduct red team/blue team exercises, cyber drills, and tabletop simulations to evaluate cyber resilience.

3. SOC Operations & Platform Optimization

• Manage and optimize SOC tools, dashboards, correlation rules, and analytics engines.
• Implement automation through SOAR playbooks, ML-based anomaly detection, and custom scripts to reduce MTTR.
• Collaborate with NOC, IT operations, fraud monitoring, and BCP/DR teams to strengthen enterprise resilience.
• Ensure forensic readiness, log management, and retention compliance.

4. Compliance, Governance & Regulatory Reporting

• Ensure adherence to regulatory guidelines from SEBI, CERT-In, and RBI.
• Implement proactive threat hunting programs to detect threats before exploitation.
• Work with security architecture and engineering teams to improve detection and prevention mechanisms.
• Develop and maintain SOC policies, SOPs, runbooks, and incident response playbooks.
• Implement and maintain a SOC maturity roadmap to enhance detection, response, and recovery capabilities.