Itsm Lead

Tekskills Inc.; Chennai; Hybrid; INR 2.500.000 - 5.000.000; Vollzeit

Zusammenfassung

Tekskills Inc. seeks a seasoned Cyber Security Architect—ITM Engineering to lead EDR/SIEM projects, detection engineering, and SOC readiness.

You will implement and optimize Defender and SentinelOne across platforms, craft KQL queries and Defender Advanced Hunting dashboards, and build SOAR playbooks with AIR integration. You will also configure WAFs (Azure/AWS/F5 DCS), manage log sources, and ensure robust threat detection while coordinating with SOC teams for incident response and risk

Qualifikationen

• Minimum 10–12 years of experience in the listed technologies and tools.
• Experience implementing, maintaining and optimizing MS Purview DLP is a plus.
• Strong knowledge of Kusto query language; playbook/workbook creation and updates; logic app configuration in MS Sentinel.
• Understanding of Linux, Windows, Active Directory, networks and security event logging.
• Ability to develop detection use cases and risk mitigations.

Aufgaben

• Provide operational and hands-on implementation in EDR, SIEM and XDR platforms.
• Manage and optimize SIEM content including filters, rules and expressions.
• Design and implement detection use cases and safety controls.
• Lead incident response and SOC readiness initiatives.
• Collaborate on Threat hunting, dashboards and Purview DLP deployments.

Kenntnisse

EDR platform management

MS Defender

SentinelOne

SIEM management

Detection engineering

Log source management

KQL logic

Defender Advanced hunting

Logic Apps

SOAR playbooks

AIR implementation

M365 Copilot

Dashboard creation

WAF configuration

Firewall/IDS tuning

SOC & incident response

Threat detection

Threat intelligence

Check Point IDS/IPS

Cisco Firepower IDS/IPS

Risk assessment

Tools

Kusto (KQL)

Logic Apps

Microsoft Defender

SentinelOne

Purview

Cisco IDS/IPS

Checkpoint IDS/IPS

F5 DCS WAF

Jobbeschreibung

• Primary mandate skill required

1. EDR platform management and optimization experience in tools :

• MS Defender and SentinelOne.

1. SIEM solution management and implementation in MS sentinel.

• Detection Engineering
• Log source management
• KQL logic and Defender Advanced hunting query building
• Logic App implementation
• SOAR playbook and use cases creation
• AIR implementation
• M365 Copilot Agent creation and implementation
• Dashboard creation and optimization
• Secondary mandate skill required Azure WAF, AWS WAF and F5 DCS WAF(Distributed cloud) – Configuration, maintenance, and optimization.
• Flexible to hire in any location – If not, please mention job location – Chennai / Bangalore / Pune / Hyderabad

• Detailed Job Description – Attached the JD.

Should have minimum 10 - 12 years of experience in the following technologies and tools including MS Defender, MS Sentinel, MS Intune, MS Purview, SentinelOne, Cisco IDS/IPS, Checkpoint IDS/IPS, F5 DCS WAF.

Experience in implementing, maintaining, and optimizing MS Purview DLP solutions will be good to have.

Should have knowledge in Kusto query language; playbook & workbook creation and updation, logic app configuration in MS Sentinel.

Understanding of Linux, Windows, AD, Network, and security event logging.

In-depth understanding of security threats, threat attack methods and the current threat environment to develop detection use cases.

Ensure effective operation of SIEM content: filters, rules, expressions and other identification mechanisms of the threat and vulnerability management technologies.

Provide professional data analysis to drive further security measures and risk mitigation activities.

Strong verbal and written interpersonal communication skills.

Willingness to work in US shift timings as required to support the team or at priority calls.

Completion of one or more certifications on the below is an added advantage: SC-200, SC-100, CCNA Security, AZ-500.

Primary skillset: Cyber Security Architect - ITM Engineering

Operational and Implementation hands-on expertise in

1. EDR platform management and optimisation experience in tools : MS Defender and SentinelOne.

2. SIEM solution management and implementation in MS sentinel.

Detection Engineering

Log source management

KQL logic and Defender Advanced hunting query building

Logic App implementation

SOAR playbook and use cases creation

AIR implementation

M365 Copilot Agent creation and implementation

Dashboard creation and optimisation

3. Azure WAF, AWS WAF and F5 DCS WAF(Distributed cloud) – Configuration, maintenance, and optimisation.

4. Checkpoint and Cisco Firepower IDS/IPS rules and signature fine tuning.

5. Perform Risk Assessment and provide recommendations to improve Security posture.

6. Prior experience in SOC and incident response.