Detection and Response Engineer

Exaforce; Bengaluru; Presencial; INR 1.100.000 - 2.100.000; Tempo integral

Resumo da vaga

Exaforce is seeking an experienced Security Operations/Detection Engineer in Bengaluru to monitor and investigate security alerts across customer cloud environments. You will build and tune detection rules, conduct proactive threat hunts, and lead incident response efforts with containment and recovery guidance.

You will participate in on-call coverage, write clear incident reports, and contribute to playbooks and SOPs.

Qualificações

• 3–6+ years in security operations, detection engineering, threat hunting, or incident response.

Responsabilidades

• Monitor and investigate security alerts across customer cloud environments.

Conhecimentos

Security ops

Detection engineering

Threat hunting

Incident response

Alert triage

On-call coverage

Write detection logic

Analytical thinking

Communication

Formação

Bachelor's degree in CS/Info Security

Ferramentas

Python

Bash

SQL

Descrição da vaga

Responsibilities:

• Monitor, triage, and investigate security alerts across customer cloud environments, determining scope, impact, and root cause.
• Develop, tune, and maintain detection rules and correlation logic to improve fidelity and reduce false positives.
• Conduct proactive, hypothesis-driven threat hunts to uncover previously unknown threats and detection gaps.
• Respond to security incidents, executing containment and eradication steps and recommending recovery actions; escalat**e** high-severity incidents as appropriate.
• Participate in the team's on-call/rotational schedule to support 24/7 detection and response coverage.
• Write clear, accurate incident reports and customer-facing updates on findings and remediation guidance.
• Contribute to and maintain playbooks, runbooks, and standard operating procedures for the DRE function.
• Build scripts and automations (Python, Bash, SQL) to speed up investigations and response workflows.
• Map detections and investigations to the MITRE ATT& CK framework to track coverage.
• Share field-identified detection gaps, tooling needs, and platform feedback with Product and Engineering.
• Collaborate with Software Development, SRE, and Customer Success teams on customer onboarding and platform integrations.
• Mentor peers and share knowledge through investigation reviews, write-ups, and internal sessions.

Requirements:

• 3-6+ years of experience in security operations, detection engineering, threat hunting, or incident response.
• Hands-on experience working in a SOC or MDR environment, including alert triage and on-call/rotational coverage.
• Proven ability to write, test, and tune detection logic and correlation rules.
• Solid incident response experience, including hands-on containment, eradication, and recovery.
• Working knowledge of security in at least one major cloud provider (AWS, Azure, or GCP).
• Proficiency in scripting (Python, Bash) and querying data with SQL or similar query languages.
• Strong analytical and problem-solving skills, with attention to detail under pressure.
• Excellent written and verbal communication skills, including the ability to explain technical findings to customers.
• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

Preferred Skills:

• Deep experience across multiple cloud providers (AWS, Azure, GCP), including identity and logging services (e. g., CloudTrail, Entra ID, Cloud Audit Logs).
• Familiarity with securing code and identity repositories and SaaS platforms (e. g., GitHub, Atlassian, Okta).
• Strong working knowledge of the MITRE ATT& CK framework and applying it to detection development.
• Experience with SIEM, EDR, SOAR, or detection-as-code tooling.
• Experience working with globally distributed teams across time zones.
• Experience at a startup or high-growth security company.
• Relevant certifications (e. g., GCIH, GCFA, GCIA, AWS/Azure/GCP security certifications, OSCP) are a plus.