Engineer - Captive Operations

Tata Communications; Mumbai; On-site; INR 600,000 - 900,000; Full time

Job summary

Tata Communications is seeking a Security Operations Center (SOC) analyst to monitor SIEM alerts 24x7 and perform initial triage. You will validate security events, analyze logs from Firewall, WAF, EDR, AD, DNS, VPN and other devices, and escalate confirmed incidents to L2/L3 teams within SLAs.

Responsibilities include maintaining shift handovers, updating tickets with evidence, supporting incident and vulnerability investigations, and following SOPs and playbooks to ensure timely response and

Responsibilities

• 24x7 monitoring of SIEM alerts and security events.
• Initial alert triage and validate security events.
• Analyze logs from Firewall, WAF, Proxy, EDR, Windows/Linux, AD, DNS, VPN, Email Security and other security devices.
• Identify True Positive (TP) and False Positive (FP) alerts.
• Escalate confirmed/suspicious incidents to L2/L3 as per the escalation matrix.
• Create and update tickets with complete investigation details and evidence.
• Ensure alerts and incidents are handled within defined SLA/KPI timelines.
• Maintain proper shift handover and communicate all pending/high-priority incidents.
• Follow documented SOPs, playbooks and escalation procedures.
• Support daily SOC reports, incident reports and shift reports.
• Monitor SIEM health, log source connectivity and report ingestion issues to the respective teams.
• Participate in incident response, vulnerability-related investigations and security investigations as required.
• Maintain confidentiality and follow organizational security policies.

Job description

Responsibilities

• Responsible for 24x7 monitoring of SIEM alerts and security events, performing initial alert triage, identifying potential security incidents, and escalating confirmed or suspicious events to L2/L3 teams within defined SLAs.
• Monitor SIEM dashboards, alerts, events and security incidents on a 24x7 basis.
• Perform L1 alert triage and validate security events.
• Analyze logs from Firewall, WAF, Proxy, EDR, Windows/Linux, AD, DNS, VPN, Email Security and other security devices.
• Identify True Positive (TP) and False Positive (FP) alerts.
• Perform initial investigation of suspicious IPs, domains, URLs, hashes, users and hosts.
• Correlate events from multiple log sources to identify potential threats.
• Escalate confirmed/suspicious incidents to L2/L3 as per the defined escalation matrix.
• Create and update tickets with complete investigation details and evidence.
• Ensure alerts and incidents are handled within defined SLA/KPI timelines.
• Maintain proper shift handover and communicate all pending/high-priority incidents.
• Follow documented SOPs, playbooks and escalation procedures.
• Support daily SOC reports, incident reports and shift reports.
• Monitor SIEM health, log source connectivity and report ingestion issues to the respective teams.
• Participate in incident response, vulnerability-related investigations and security investigations as required.
• Maintain confidentiality and follow organizational security policies.