Security Analyst 2

Mobikwik; Gurugram District; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Mobikwik is seeking a security professional to implement and manage a SOC/SIEM platform on site in Gurugram. You will develop and tune SIEM rules, onboard integrations, and investigate escalated alerts across network, cloud, and endpoint telemetry.

The role requires hands-on experience with SOC/SIEM, log-source integrations, and RCA capabilities. Knowledge of MITRE ATT&CK mapping and WAF/VPN/DLP concepts is highly desirable.

Qualifications

• Hands-on SOC/SIEM implementation is mandatory.
• SIEM use-case and rule optimization is mandatory.
• Security device and log-source integration is mandatory.
• L2 incident investigation and RCA experience is mandatory.
• Strong understanding of Firewall, VPN, DLP and WAF.

Responsibilities

• Hands-on implementation and administration of at least one SOC/SIEM platform.
• Develop and tune SIEM use cases, rules and alerts to reduce false positives.
• Onboard and troubleshoot security device/log-source integrations.
• Investigate L1 escalated alerts and perform detailed RCA.
• Identify attack vectors and recommend containment and remediation.
• Monitor events from Firewall, WAF, DLP, VPN, EDR/XDR, IAM/AD, Cloud and endpoints.
• Understand L7/WAF security and MITRE ATT&CK mapping would help.
• Develop detection capabilities against emerging threats.

Skills

SOC/SIEM implementation

SIEM use-case optimization

Log-source integration

L2 incident investigation

Firewall/VPN/DLP/WAF

IAM/AD knowledge

Cloud/AWS security

Linux investigation

Analytical troubleshooting

Job description

Key Responsibilities

• Hands-on implementation and administration of at least one SOC/SIEM platform.
• Develop, tune, and optimize SIEM use cases, correlation rules, and alerts to reduce false positives and improve detection.
• Onboard and troubleshoot security device/log-source integrations with the SOC/SIEM.
• Investigate L1-escalated alerts by correlating logs across multiple security controls and perform detailed RCA.
• Identify attack vectors, IOCs, affected systems/users, and recommend containment and remediation.
• Monitor and investigate security events from Firewall, WAF, DLP, VPN, EDR/XDR, IAM/AD, Cloud and endpoints.
• Strong understanding of Firewall L2/L3/L4 concepts including ACL, NAT, routing and VPN.
• Good understanding of L7/WAF security, OWASP Top 10, web attacks and API security; Cloudflare WAF experience preferred.
• Working knowledge of DLP, IAM/AD, AWS/Cloud security and Linux investigation.
• Develop and improve detection capabilities based on emerging threats, preferably mapped to MITRE ATT&CK.

Mandatory Skills

• Hands-on SOC/SIEM implementation Mandatory
• SIEM use-case/rule optimization – Mandatory
• Security device/log-source integration – Mandatory
• L2 incident investigation and RCA – Mandatory
• Firewall, VPN, DLP and WAF understanding
• IAM/AD, Cloud/AWS and Linux knowledge
• Strong analytical and troubleshooting skills