Lead SOC Analyst -Triage, Detection Engineering & Threat Hunting

Neurealm; Pune District, Chennai, Bengaluru; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

Neurealm Company seeks a senior SOC analyst and shift lead to investigate escalated alerts end to end, determine real threats, and hand off scoped incidents to responders. You will build and tune detections, run threat hunts, and mentor the SOC team to sharpen detection engineering ownership.

The role requires 10 years in security, strong CrowdStrike Falcon experience, and the ability to work 24x7 shifts while driving metrics and process improvements.

Qualifications

• 10 years in security, with at least 6 in a SOC.
• Strong CrowdStrike Falcon experience (Insight XDR, Next-Gen SIEM).
• Proven detection engineering: writing/tuning SIEM rules.
• Solid knowledge of Windows, Linux, AD, Entra ID, Azure and M365 logs.
• Working knowledge of MITRE ATT&CK and threat intel.
• Comfortable with 24x7 rotational shifts and leading a shift team.

Responsibilities

• Triage and investigate escalated alerts end to end, decide real vs false positive.
• Lead shift tasks: assign work, ensure SLA adherence, handovers.
• Mentor junior analysts and review investigations for quality.
• Document investigations with evidence, decisions and timelines.
• Write, test and tune detection rules mapped to MITRE ATT&CK.
• Run threat hunts and convert findings into durable detections.

Tools

CrowdStrike Falcon Next-Gen SIEM

Falcon Fusion SOAR

MITRE ATT&CK

Job description

Role summary

You will be the senior analyst and shift lead on the SOC floor. You will investigate escalated alerts end to end, decide what is real, and either close it with evidence or hand a well‑scoped incident to the Incident Responders. Between alerts, you will build and tune detections and run threat hunts so the SOC gets sharper every week. The role is pitched at 10 years because it carries shift‑lead, mentoring and detection‑engineering ownership.

Key responsibilities

Triage and investigation

• Investigate escalated alerts from CrowdStrike Falcon, Falcon Next‑Gen SIEM, Entra ID, Azure and network/email sources.
• Correlate endpoint, identity, cloud and network evidence to confirm or rule out compromise.
• Perform first‑response containment within agreed playbooks (host isolation, account disable, session revoke) and elevate to IR with a clear summary.
• Document every investigation with evidence, decisions and timelines.

Detection engineering

• Write, test and tune detection rules in Falcon Next‑Gen SIEM (CrowdStrike Query Language / LogScale), mapped to MITRE ATT&CK.
• Reduce false positives and alert fatigue through tuning, enrichment and suppression logic.
• Build and maintain Falcon Fusion SOAR automation for enrichment, triage and response steps.
• Track detection coverage against ATT&CK and close priority gaps, including healthcare‑relevant threats.

Threat hunting

• Run regular hypothesis‑driven hunts using threat intelligence, ATT&CK techniques and recent incident learnings.
• Hunt for identity abuse in Entra ID and AD, living‑off‑the‑land activity, persistence and lateral movement.
• Convert hunt findings into durable detections.

Shift leadership

• Lead the shift: assign work, ensure SLA adherence and run clean handovers.
• Mentor junior analysts and review their investigations for quality.
• Report shift metrics (alert volume, MTTD, MTTR, escalation quality) and drive process improvements.

Must‑have skills

• 10 years in security, at least 6 in a SOC with hands‑on L2 or L3 investigation.
• Strong CrowdStrike Falcon experience (Insight XDR console, Next‑Gen SIEM queries, Fusion SOAR).
• Proven detection engineering: writing and tuning rules in a SIEM query language, with measurable false‑positive reduction.
• Solid knowledge of Windows, Linux, Active Directory, Entra ID, Azure and M365 logs and attack patterns.
• Working knowledge of MITRE ATT&CK, the cyber kill chain and threat intelligence.
• Comfortable with 24x7 rotational shifts and leading a shift team.

Good to have

• Scripting in Python or PowerShell for enrichment and automation.
• Detection‑as‑code practices (version control, testing, peer review for rules).
• Healthcare or pharma SOC experience.
• Certifications: CrowdStrike CCFA/CCFH/CCFR, GCIA, GCIH, GCTI, BTL2, or equivalent.
• Looking for Immediate Joiners

What success looks like in 12 months

• False‑positive rate on top‑volume detections cut significantly, with tuning documented.
• At least 20 new or reworked detections in production, each mapped to ATT&CK.
• A regular hunt cadence (for example, monthly) with findings feeding detections.
• Escalations to IR consistently well‑scoped and evidence‑backed.