Infosec Engineer

Nemetschek Group; Hyderabad; On-site; INR 900,000 - 1,500,000; Full time

Job summary

Nemetschek India Private Limited is seeking a dedicated SOC Analyst for permanent night shift in Hyderabad. You will focus on high-quality alert triage and first-line incident handling using CrowdStrike Falcon, Microsoft Sentinel, and related tools to protect a global environment while most of the company sleeps.

The role requires 3–5 years in a SOC, experience in 24/7 operations, and strong written English to document investigations and handovers clearly.

Qualifications

• 3–5 years hands-on SOC experience in monitoring and triage.
• Ability to work in a 24/7/rotation SOC with SLAs.
• Experience with at least one enterprise EDR/XDR platform (CrowdStrike Falcon).
• Experience with a SIEM (Microsoft Sentinel) for correlations and queries.
• Familiarity with vulnerability management (Tenable) and phishing protections.

Responsibilities

• Monitor and triage security alerts from EDR/XDR and SIEM, perform L1/L1.5 incident handling.
• Apply runbooks to respond (isolate host, block hash/domain, account disabling with approval).
• Review detections, provide context, and escalate when needed; produce end-of-shift handover notes.
• Investigate phishing alerts and user-reported suspicious emails using defined playbooks.
• Keep incident records up-to-date with concise investigations and observations.

Skills

SOC monitoring

Alert triage

Incident handling

English communication

Education

CompTIA Security+

CySA+

CEH

Vendor SOC/EDR certifications

Tools

CrowdStrike Falcon

Microsoft Sentinel

Tenable

Secure email gateways

Job description

Company Description

Nemetschek India Private Limited is a global organization and with a legacy of over half a century.

Nemetschek India Private Limited is a global organization and with a legacy of over half a century.

It is a public company listed on MDAX and TecDAX (Germany) stock exchanges. The Nemetschek Group is a forerunner of digital transformation in the AEC/O (Architecture, Engineering, Construction & Operations) industry and covers the entire life cycle of construction and infrastructure projects. With intelligent software solutions, we lead our customers into the future of digitalization. By using our solutions customers can plan, build, manage, and operate buildings and infrastructure projects.

Job Description

YOUR ROLE: A chance to make the difference.

We’re looking for a SOC Analyst for our permanent night shift in Hyderabad to focus on high-quality alert triage and first-line incident handling. You’ll work mainly with CrowdStrike Falcon, Microsoft Sentinel, and related security tools to keep our global environment safe while most of the company is asleep.

Experience

• 3–5 years in a SOC / security monitoring role (L1 or L1/L2 mix).
• Prior experience in a 24/7 or shift-based SOC is a plus.

Shift details

• Location: Hyderabad.
• Permanent night shift, working with EMEA/US time zones.
• Participation in a rotation that may include weekends and holidays.
• Clear handover required at the end of each shift to the next region/shift.

ROLES AND RESPONSIBILITY: (Night Shift, triage-focused)

• Monitor and triage security alerts from EDR/XDR (primarily CrowdStrike Falcon), SIEM (Microsoft Sentinel), and other security tools.
• Perform alert-driven incident handling at L1/L1.5 level: Quickly review new detections, Decide whether to close as benign/false positive, investigate further, or elevate, Apply standard playbook-based response actions where allowed (e.g. isolate host, block hash/domain, disable account with approval).
• For CrowdStrike Falcon in particular: Review detections, examine process trees and related activity, Validate severity and impact based on context, Close noise/false positives with clear justification or elevate meaningful events. Use Microsoft Sentinel and other platforms to pull additional context during triage (host history, user activity, geo/access patterns, related alerts).
• Analyze and respond to phishing alerts and user-reported suspicious emails using defined playbooks (header analysis, URL/file sandboxing, user follow-up, ticket updates).
• Review vulnerability scan results (e.g. Tenable) for basic risk context, confirm exposure where needed, and follow up with the relevant teams according to priority and SLAs.
• Conduct basic, playbook-driven “mini threat hunting” during quieter periods (e.g. running saved queries/hunts in Sentinel and EDR to look for common attacker techniques or newly published IOCs). Keep tickets, incident records, and runbooks up to date with short, precise, and complete investigation notes (what triggered, what you checked, what you decided, and why).
• Produce clear shift-end handover notes for open incidents and important observations.

Who Are We Looking For

Core SOC / triage skills

• 3–5 years of hands-on SOC experience in monitoring, triage, and first-line incident handling (L1 or L1/L2).
• Strong focus on alert triage rather than deep forensics: able to work through a queue efficiently, recognize patterns, and make clear decisions (close, investigate further, elevate).
• Experience with: At least one enterprise EDR/XDR platform (ideally CrowdStrike Falcon) for alert analysis and basic response (host isolation, hash/domain blocking, evidence collection).
• A SIEM platform (ideally Microsoft Sentinel) for correlating alerts and running queries to gather additional context.
• Good understanding of security fundamentals: Logs: endpoint, authentication, OS, and basic application logs.; Endpoints: Windows and/or Linux basics, common processes and admin tools.; Networks: TCP/IP basics, DNS, web traffic, VPN and remote access patterns.; Common attack techniques across the kill chain (phishing, credential theft, lateral movement, malware execution, C2, data exfiltration).

Tools and platforms

• Familiarity with some of the following (or similar solutions): CrowdStrike Falcon or another modern EDR/XDR platform.
• Microsoft Sentinel or another SIEM (including experience running and understanding queries; KQL is a plus).
• Vulnerability management tools such as Tenable.
• Email security / anti-phishing tools, sandboxing, or secure email gateways.

Ways of working and soft skills

Comfortable working permanently in night shift and collaborating with global teams spread across regions.

• Strong written communication: able to document alerts, investigations, and handovers in clear, concise English.
• Ability to stay calm, structured, and pragmatic during active incidents and high-alert periods.
• Habit of following runbooks and escalation paths, while also giving feedback when you see gaps or improvement opportunities.
• Ownership mindset: you close the loop on alerts you touch, or you hand them over with enough context that the next person can continue smoothly.

Qualifications

Nice to have

• Experience in a 24/7 SOC environment with strict SLAs.
• Hands-on experience specifically with CrowdStrike Falcon and Microsoft Sentinel in a production environment.
• Exposure to SOAR / automation and working with automated playbooks for common use cases (phishing, malware, brute force, etc.).
• Familiarity with basic vulnerability prioritization (CVSS concepts, asset criticality).
• Security certifications such as: CompTIA Security+, CySA+, CEH, Vendor-specific SOC/EDR/XDR certifications (including CrowdStrike, Microsoft, etc.).

Growth and development

Even though this role is centered on triage, we want people who are interested in growing further within the SOC. Over time, you’ll have opportunities to:

• Take on more complex investigations and incident response tasks under guidance from senior analysts.
• Get involved in improving detection rules, tuning alerts, and enhancing runbooks.
• Develop towards specialist tracks such as incident response, threat hunting, or detection engineering depending on your strengths and interests.

Additional Information

#NemetschekIndia