Security Analyst

Litmos; India; On-site; INR 2,400,000 - 3,200,000; Full time

Job summary

Litmos is hiring a Senior SOC Analyst to join a lean global security operations team based in Pune. You will own the full incident lifecycle during non-US hours, including triage, investigation, containment, and documentation, functioning as both an L2 investigator and L3 responder when needed.

You will analyze security events across SIEM/EDR, produce root cause reports, and maintain incident playbooks. Expect collaboration with a US-based analyst and leadership, with shift handoffs ensuring

Qualifications

• Bachelors in CS/IT/Electronics or related field.
• 4–6 years in SOC or cybersecurity operations with L2/L3 duties.
• Hands-on with SIEM platforms (Splunk, MS Sentinel, QRadar, or similar).
• Strong experience with EDR tools (CrowdStrike, Defender, SentinelOne, or similar).
• Advanced log analysis across Windows, Linux, cloud, and identity platforms.
• Strong knowledge of MITRE ATT&CK framework.
• Ability to work independently and manage incidents end-to-end.
• Excellent written and verbal English communication; shift handover notes.

Responsibilities

• Own the full incident lifecycle during non-US hours — from triage to containment, remediation and documentation.
• Investigate security events across SIEM, EDR, email security, network, identity, and cloud.
• Produce clear, actionable incident reports including root cause analyses.
• Escalate incidents with a summary and recommended action to the Director of Security Operations.
• Provide detailed shift handoff notes to the US-based analyst to ensure continuity.
• Develop and maintain incident response playbooks and SOC runbooks.
• Maintain up-to-date documentation across active and closed incidents.
• Contribute to SOC metrics, trends, and reporting for leadership.
• Identify opportunities to improve SOC processes, tooling, and automation.
• Collaborate with US-based analyst and Director during overlap windows.
• Serve as primary India-based SOC contact during non-US hours.

Skills

SIEM experience

EDR experience

Log analysis

Cloud platforms

Incident response

Communication

Education

Bachelor's degree in CS/IT/Electronics

Tools

Splunk

Microsoft Sentinel

IBM QRadar

CrowdStrike Falcon

Microsoft Defender

SentinelOne

Azure AD

Job description

Job Description

Are you looking for an opportunity to help solve one of todays biggest business challenges? AI is changing the pace of business, and organizations everywhere are struggling to help their workforce, partners, and customers keep up. At Litmos, were building the Learning Acceleration Platform that helps organizations build human capability faster—and were looking for people who are passionate about making a meaningful impact for customers while growing alongside a collaborative, people-first team.

Litmos is the Learning Acceleration Platform that helps organizations build capability faster, adapt at the speed business changes, and scale learning to anyone, anywhere. Combining an intuitive platform, AI-powered capabilities, trusted content, expert services, and a broad ecosystem of integrations, Litmos helps organizations accelerate workforce productivity, improve customer adoption and retention, enable high-performing partners, and reduce organizational risk through continuous learning.

Organizations such as Hewlett Packard Enterprise, Graco, Sabre, and Russell Mineral Equipment trust Litmos to accelerate learning across their workforce, partners, and customers. Today, more than 11K customers with 30 million learners across 150 countries and 37 languages use Litmos to build the capabilities their organizations need to succeed. Backed by Francisco Partners, one of the worlds leading technology investment firms, were investing in the future of learning—and the people who are building it. Learn more at www.litmos.com.

About the Role

We are looking for a senior, self-directed SOC Analyst to join our lean global security operations team based in Pune. As the sole security operations resource during non-US business hours, you will own the full spectrum of alert triage, incident investigation, and response for your shift. This role requires someone who can function as both an L2 investigator and an L3 responder depending on the situation, without relying on a senior analyst to hand off to.

Responsibilities

Incident Investigation & Response

• Own the full incident lifecycle during non-US hours — from initial triage through containment, remediation, and documentation
• Conduct in-depth investigation of security events across SIEM, EDR, email security, network, identity, and cloud platforms
• Perform root cause analysis on confirmed incidents and produce clear, actionable incident reports
• Escalate incidents to the Director of Security Operations with a clear situation summary and recommended course of action
• Provide detailed shift handoff notes to the US-based security analyst at transition, ensuring full continuity of open investigations

Process & Documentation

• Develop, maintain, and improve incident response playbooks and SOC runbooks
• Maintain accurate and up-to-date documentation across all active and closed incidents
• Contribute to weekly and monthly SOC metrics, trend analysis, and reporting for the Director of Security Operations
• Identify opportunities to improve SOC processes, tooling, and automation and bring recommendations to the team

Collaboration

• Work closely with the US-based security analyst and Director of Security Operations during shift overlap windows to align on priorities, open incidents, and ongoing investigations
• Serve as the primary security operations contact for any India-based stakeholders or teams during non-US hours

Qualifications

• Bachelors degree in Computer Science, Information Technology, Electronics, or a related field (B.E. / B.Tech / BCA / B.Sc. IT preferred)
• 4-6 years of experience in SOC or cybersecurity operations, with demonstrated experience performing both L2 investigation and L3 response duties
• Hands-on experience with SIEM platforms (Splunk, Microsoft Sentinel, IBM QRadar, or similar)
• Strong experience with EDR tools (CrowdStrike Falcon, Microsoft Defender, SentinelOne, or similar)
• Advanced log analysis skills across Windows, Linux, cloud (AWS, Azure, GCP), and identity platforms (Active Directory, Azure AD)
• Strong working knowledge of the MITRE ATT&CK framework
• Demonstrated ability to work independently, make sound decisions under pressure, and manage incidents end-to-end without real-time senior support
• Excellent written and verbal communication skills in English — including the ability to write clear incident reports, escalation summaries, and shift handoff notes for a global team
• Comfortable working non-US business hours

Nice to Have

• Certifications: CompTIA CySA+, GCIH, GCFE, GCFA, SC-200, or equivalent
• Experience with SOAR platforms and alert automation or basic scripting (Python, PowerShell) for SOC workflow improvement
• Exposure to cloud security monitoring (AWS GuardDuty, Microsoft Defender for Cloud, Azure Sentinel, etc.)
• Experience operating in a small or lean security team with broad individual ownership
• Familiarity with GRC concepts and compliance frameworks (SOC 2, ISO 27001, NIST) to support cross-team collaboration

Salary Range

₹24,00,000 to ₹32,00,000 plus 10% bonus

We are an equal opportunity workplace employer. We are committed to the values of Equal Employment Opportunity and provide accessibility accommodations to applicants with physical and/or mental disabilities.

Applicants will receive consideration for employment without regard to their age, race, religion, national origin, ethnicity, age, gender (including pregnancy, childbirth, et al), sexual orientation, gender identity or expression, protected veteran status, or disability.