Manager - Cybersecurity Operations

Tata Communications Limited; Bengaluru; In loco; INR 1.500.000 - 2.300.000; Tempo pieno

Descrizione del lavoro

Tata Communications Limited is seeking an experienced L3 SIEM professional to lead complex incident response, forensic analysis, and SIEM optimization across on-prem and cloud environments. You will design log source integrations, develop advanced detection use cases, and drive automation via SOAR and related tools.

The role emphasizes governance, compliance, and collaboration with cross-functional teams to strengthen security maturity and provide customers with timely, insightful reporting and

Competenze

• Experience handling complex security incidents and investigations.
• Strong skills in forensic analysis and root cause determination.
• Hands-on with SIEM administration and log parsing.
• Familiarity with SOAR, EDR, IAM and firewall technologies.
• Ability to design and onboard new log sources across environments.
• Proficiency in developing detection use cases and automation.

Mansioni

• Support L2 in handling complex and critical security incidents.
• Perform deep forensic analysis and root cause identification.
• Investigate sophisticated threats (APT, zero-day behavior, stealth attacks).
• Provide final technical validation and resolution guidance.
• Manage upgrades, patches, and hotfix deployments for system monitor agents.
• Ensure Log Source MPS volume analysis across sources.
• Design and onboard new log sources across on-prem and cloud environments.
• Develop and maintain parsing logic, normalization, and field mappings.
• Resolve complex ingestion issues and ensure data quality across sources.
• Design and implement advanced correlation rules and detection logic.
• Build use cases aligned with MITRE ATT&CK framework and threat intel feeds.
• Integrate automation into detection workflows and SOAR integrations.
• Enhance detection coverage and reduce blind spots through iteration.
• Add/maintain automation workflows and response playbooks for SIEM.
• Integrate SIEM with SOAR and security tools (EDR, IAM, Firewall).
• Optimize response time via orchestration and automation.
• Diagnose and resolve log source issues and pipeline bottlenecks.
• Improve pipelines, indexing, and query performance.
• Define SIEM standards, architecture guidelines, and best practices.
• Ensure regulatory/compliance alignment and support audits.
• Maintain documentation for configurations, integrations, and fixes.
• Act as escalation point for L2 and provide technical leadership.

Conoscenze

Incident response

Root cause analysis

Forensic analysis

Threat hunting

SIEM administration

Log parsing

Strumenti

SOAR

EDR

IAM

Firewall

Log source management

Descrizione del lavoro

L3 SIEM - Roles Responsibilities

Experience (8-12 Years)

1.Advanced Incident Support Root Cause Analysis

• Support L2 in handling complex and critical security incidents
• Perform deep forensic analysis and root cause identification
• Investigate sophisticated threats (APT, zero-day behavior, stealth attacks)
• Provide final technical validation and resolution guidance

2.SIEM Agent Management

• Manage upgrades, patches, and hotfix deployments for System monitor agents
• Ensure Log Source MPS volume analysis

3.Log Source Integration Parsing

• Design and onboard new log sources across on-prem and cloud environments
• Develop and maintain parsing logic, normalization, and field mappings
• Resolve complex ingestion issues (protocol, TLS, format mismatches)
• Ensure data quality and consistency across all sources

4.Detection Use Case Development

• Design and implement advanced correlation rules and detection logic
• Build new use cases aligned with frameworks like MITRE ATTCK
• Integrate threat intelligence feeds and automation into detection workflows
• Continuously enhance detection coverage and reduce blind spots

5.Automation SOAR Integration

• Add/Maintain automation workflows and response playbooks
• Integrate SIEM with SOAR and other security tools (EDR, IAM, Firewall)
• Optimize response time through orchestration and automation

6.Performance Optimization Troubleshooting

• Diagnosing and resolving log source- issues
• Optimize pipelines, indexing, and query performance

7.Governance, Compliance Best Practices

• Define SIEM standards, architecture guidelines, and best practices
• Ensure compliance with regulatory and audit requirements and support customers on Audits
• Maintain documentation for configurations, integrations, and fixes

8.Collaboration Technical Leadership

• Act as the escalation point for L2 and guide them on complex investigations
• Provide technical leadership, mentoring, and knowledge sharing
• Collaborate with infrastructure, cloud, and application teams

9.Continuous Improvement Innovation

• Identify gaps in detection, logging, and response capabilities of log sources
• Driving use case enhancements and modernization initiatives
• Evaluate and implement new security technologies and integrations and validate overall security maturity assessment.

10.Reports

• Based on customers, Drive Daily/ Weekly/ Monthly/ Quarterly reports
• Provide visibility and drive calls with customers.