Lead Analyst Cyber Security

Purview Services; Hyderabad; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

Purview Services seeks a Cybersecurity Technology Operations Engineer to join the Global Cybersecurity Service Resilience team. You will maintain and operate cybersecurity tooling to ensure availability and security across the organization.

Responsibilities include supporting operations for endpoint, data, network, application security and SIEM/SOAR, automating tasks, setting up monitoring, performing installations and upgrades, and contributing to ITIL processes.

Qualifications

• Experience administering and supporting multiple security tools across endpoints, networks, applications, and data security.
• Familiarity with Unix and Windows operating systems is required.
• Experience with SIEM/SOAR platforms (Splunk ES/Splunk SOAR) is essential.
• Proficiency in at least one scripting language (Perl/PowerShell/Python) desired.
• Strong analytical and problem solving skills and clear communication required.

Responsibilities

• Provide end-to-end admin and production support for cybersecurity tools including Endpoint, Data, Network, Application security and SIEM/SOAR.
• Automate repetitive tasks and create SOPs to improve operational efficiency.
• Setup monitoring and event management to ensure tool uptime and performance.
• Perform installations, upgrades, and routine maintenance of cybersecurity applications.
• Work with ITIL processes and support transitions between teams.
• Participate in weekend on-call rotations as needed.

Skills

Endpoint security

Network security

Application security

Data security

SIEM/SOAR

Unix & Windows

Cloud AWS familiarity

Scripting (Perl/PowerShell/Python)

Communication skills

Problem solving

Tools

McAfee ENS

CrowdStrike

ISE/NAC

Nessus/Tenable

Docker security

Symantec DLP

Splunk ES

Splunk SOAR

Job description

The Cybersecurity Technology Operations Engineer will be a member of the Global Cybersecurity Service Resilience (CSR) team. This team is responsible for the maintenance and operation of all technologies the wider cyber functions rely on. This ensures that the highest standards of availability and security are maintained across all Cybersecurity tooling and that the function will maintain capability in the light of significant organizational disruption.

Main Duties:

• Serve as Security Engineer supporting technical operations for critical cybersecurity technologies.
• Provide end to end administration and production support for cybersecurity tools under Endpoint Security, Data Security, Network Security, Application Security and SIEM/SOAR.
• Analyze, investigate, remediate cybersecurity application incidents in operational/production environment.
• Automate repeated and operational tasks through programming (Perl, Python, PHP, Bash, or PowerShell) or other interfaces.
• Setup monitoring and event management for cyber security products to help manage availability, reliability, and performance.
• Perform cybersecurity application installation, upgrades, product hygiene and maintenance.
• Operate in accordance with ITIL processes such as Change Management process, Incident Management and Problem Management.
• Lead product support transitions on both technical and process front.
• Identify operational gaps and drive continual service improvement plans for existing processes.
• Build tool knowledgebase and establish/enhance Standard Operation Procedures (SOP)
• Work with minimal supervision and conduct activities as a collaborative partner to Cyber Security as well as other lines of business (LOBs)
• Develop and produce operational metrics such as Change success rate, tool uptime report, Incident ticket volume etc.
• The role demands weekend support on rotation through active/passive on calls.

Requirements:

• Relevant experience in tool administration and support of at least 2 + tools in one or more areas is MUST
• Endpoint security (McAfee ENS, CrowdStrike or any EDR solution)
• Network security (ISE/NAC solutions, Network segmentation, Web proxy solutions)
• Application security (Nessus/Tenable, Container/Docker security.)
• Data Security (Industry leading DLP technology such as Symantec or MacAfee DLP)
• SIEM/SOAR (Splunk ES, Splunk SOAR)
• Familiarity with Unix & Windows operating system is a MUST.
• Experience working on Amazon web services (Compute, Storage and Networking) is nice to have.
• Experience with any one of the script languages such as Perl/PowerShell/Python is desired.
• Must possess clear oral and written communication skills and be able to clearly articulate complex concepts to broader audience.
• Excellent analytical and problem-solving skills ability to get to the root of the problem, assess impact, and develop a resolution plan quickly, leveraging all available resources, is essential.
• Must take ownership of tasks and demonstrate high degree of responsibility to ensure completion.