Security Engineer

First Advantage; India; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

First Advantage is seeking a Security Engineer at an intermediate level to handle Level 2 and 3 SOC escalations, develop detections, and contribute to SOC engineering projects. You will analyze telemetry across endpoints, cloud, and applications, and help automate responses using approved playbooks.

Responsibilities include building and tuning detections for SIEM/XDR/EDR, supporting platform integrations with Sentinel/Defender, and performing threat hunts to improve visibility and containment.

Qualifications

• General knowledge of security operations, incident response, detection engineering.
• Hands-on experience with SIEM, EDR/XDR, SOAR.
• Experience using KQL, SPL, SQL or a comparable query language.
• Foundational automation experience with PowerShell or Python.

Responsibilities

• Investigate and resolve Level 2 and 3 alerts, cases, and incidents.
• Analyze telemetry across endpoint, identity, email, cloud, network, and applications.
• Develop, test, deploy, tune, and document detections for SIEM, XDR, EDR, and cloud.
• Develop enrichment, triage, notification, containment, and remediation workflows for Tier 1.
• Perform scoped threat hunts and retrospective searches.
• Support telemetry onboarding, platform configuration, integrations, and troubleshooting.
• Maintain case records, detection docs, and runbooks.

Skills

Security operations

Incident response

Detection engineering

Threat hunting

Automation

Education

Bachelor's degree or equivalent

Tools

SIEM

EDR/XDR

SOAR

PowerShell

Python

APIs

Job description

The Security Engineer is an intermediate technical individual contributor who investigates and resolves Level 2 and Level 3 SOC escalations, develops and tunes detections, builds approved automation, and contributes to SOC engineering projects. The role applies general knowledge of industry practices, techniques, standards, concepts, and principles to technical problems of moderate scope and complexity.

Key Responsibilities

• Investigate and resolve Level 2 and Level 3 alerts, cases, and incidents using established procedures, playbooks, and escalation paths.
• Analyze endpoint, identity, email, cloud, network, and application telemetry to validate activity, determine scope, and document findings.
• Develop, test, deploy, tune, and document detections for defined use cases across SIEM, XDR, EDR, cloud, identity, email, and other telemetry.
• Develop approved enrichment, triage, notification, containment, and remediation workflows for Tier 1 scenarios that outsourced providers cannot fully address.
• Perform scoped threat hunts and retrospective searches using documented hypotheses and established analysis methods.
• Support telemetry onboarding, platform configuration, integrations, and troubleshooting for assigned systems and use cases.
• Maintain accurate case records, detection documentation, automation runbooks, and technical procedures.
• Contribute to project milestones and elevate work that exceeds established authority, procedures, or technical scope.
• Monitor and investigate security events generated from SaaS applications, PaaS platforms, APIs, web applications, and database services, and develop detections, enrichment logic, and response workflows to improve visibility into application-layer threats and unauthorized data access.

Core Functional Responsibilities

SOC Escalations and Incident Response

Handle both Level 2 and Level 3 escalations within established procedures; conduct evidence gathering, scoping, validation, containment, remediation, recovery support, and case documentation; engage senior responders when authority, impact, or complexity exceeds defined boundaries.

Detection Engineering

Build and tune defined detections, queries, correlations, analytics rules, and incident logic; complete testing, peer review, deployment, regression validation, MITRE ATT&CK mapping, and documentation.

Tier 1 Automation

Address repeatable Tier 1 gaps that outsourced services cannot resolve by developing approved enrichment, triage, notification, containment, and remediation workflows.

SOC Platform Engineering

Support Sentinel, Defender XDR, SOAR, telemetry connectors, case management, and related integrations; troubleshoot assigned platform, rule, data-quality, and automation issues.

Application Security Monitoring & Detection Engineering

Develop and maintain detections for suspicious application activity, administrative actions, privilege changes, API abuse, authentication anomalies, database access, and data-exfiltration indicators while validating telemetry quality and monitoring coverage.

Threat Hunting and Analysis

Execute scoped hunts and retrospective searches using established hypotheses and methods; document findings and recommend detection or telemetry improvements.

Collaboration and Documentation

Coordinate routine technical work with internal teams and service providers; maintain current cases, runbooks, detection documentation, and automation procedures.

Leveling Alignment

Knowledge and problem solving

Frequent use and general knowledge of industry practices; solves problems of moderate scope and complexity.

Discretion and latitude

Works under only very general supervision. Work is reviewed for soundness of judgment and overall adequacy and accuracy. Uses established policies and practices for guidance.

Organizational impact

Contributes to milestones associated with specific projects and operational goals. Errors may delay schedules or require additional resources to correct.

Internal and external contacts

Primarily internal company contacts, with infrequent inter‑organizational or outside contact on routine matters.

Required Qualifications

• General knowledge of security operations, incident response, detection engineering, and common attacker techniques.
• Hands‑on experience with SIEM, EDR/XDR, SOAR, or comparable security technologies.
• Experience using KQL, SPL, SQL, or a comparable query language.
• Foundational experience with PowerShell, Python, APIs, or comparable automation technologies.
• Ability to document technical findings clearly and exercise sound escalation judgment.
• Experience investigating endpoint, identity, email, cloud, network, or application security activity and preserving clear evidence of analysis.
• Working understanding of incident classification, escalation, containment, remediation, and recovery practices.
• Ability to use established engineering standards, peer review, source control, testing, and controlled deployment processes.
• Ability to balance concurrent incidents and engineering work, communicate status, and request guidance when scope or authority is exceeded.

Education And Experience

Bachelor + 2 years; Master + 0 years; PhD + 0 years; or equivalent. Relevant equivalent knowledge or work experience may be considered in accordance with the FA Technical Leveling definitions.

Preferred Qualifications

• Hands‑on experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Azure, AWS, or Microsoft 365.
• Experience working with an outsourced SOC, MDR, MSSP, or managed threat hunting provider.
• Experience creating security rules, playbooks, automation workflows, response actions, dashboards, or operational metrics.
• Relevant certifications such as SC-200, Security+, CySA+, AZ-500, or equivalent.

Measures of Success

• Accurate and timely resolution of assigned Level 2 and Level 3 escalations.
• Reliable detections and automations delivered in accordance with team standards.
• Reduction in repetitive Tier 1 escalations through approved playbooks and automation.
• Complete and usable case, detection, and workflow documentation.

We have great people here and are looking for more. Come join us!

Equal Employment Opportunities at First Advantage

First Advantage is an equal opportunity employer. We are committed to providing a workplace and recruitment process that is free from unlawful discrimination, harassment, and retaliation. Employment decisions at First Advantage are based solely on qualifications, merit, and business needs. We do not discriminate in any aspect of employment on the basis of race, color, national origin, ancestry, citizenship, religion, creed, sex, gender identity, gender expression, sexual orientation, marital or family status, pregnancy, age, physical or mental disability, medical condition, genetic information, veteran or military status, or any other characteristic protected by applicable law.