Security operations analyst

Jobgether; India; On-site; INR 1,800,000 - 2,800,000; Full time

Benefits offered by this job

Modern enterprise cybersecurity tech

Hands-on Cortex XSIAM/XSOAR and CrowdX

Multi-cloud security exposure

Collaboration with international teams

Job summary

Jobgether on behalf of a partner company is seeking a Security Operations Analyst based in India. You will strengthen enterprise cybersecurity through security operations engineering, threat detection, and automated incident response across SIEM, SOAR, and multi-cloud environments.

You will work with Palo Alto Cortex XSIAM/XSOAR and CrowdStrike Falcon, design detections, maintain integrations, and support Tier 2/3 investigations while collaborating with IT and infrastructure teams.

Qualifications

• H Hands-on experience in Security Operations and SIEM/SOAR engineering.
• Strong expertise in Cortex XSIAM and XSOAR.
• Experience with endpoint security and incident response.
• Cloud security logging across AWS, Azure, and GCP.
• Knowledge of MITRE ATT&CK and threat intelligence.
• Excellent documentation and communication skills.

Responsibilities

• Design, deploy, and maintain log source integrations for Cortex XSIAM/XSOAR.
• Manage detection rules, dashboards, and alert thresholds.
• Administer CrowdStrike Falcon and RTR workflows.
• Configure multi-cloud security log collection (AWS/Azure/GCP).
• Maintain least-privilege IAM and identity security monitoring.
• Provide Tier 2/3 SOC engineering support.
• Translate threat intel into detection logic.
• Contribute to weekly/monthly SOC reports.

Skills

Security Operations

Threat Detection

Incident Response

SOC Engineering

Collaboration

Tools

Palo Alto Cortex XSIAM

Palo Alto Cortex XSOAR

CrowdStrike Falcon

AWS

Azure

GCP

Entra ID

Microsoft Defender for Cloud

SIEM

Job description

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Security Operations Analyst based in India.

In this role, you will play a key part in strengthening enterprise cybersecurity through security operations engineering, threat detection, and automated incident response. You will design, deploy, and maintain security integrations across SIEM, SOAR, endpoint protection, and multi-cloud environments. Working extensively with Palo Alto Cortex and CrowdStrike Falcon, you will help ensure that security telemetry is accurate, actionable, and aligned with evolving threat landscapes. You will collaborate with Security Operations, IT, and infrastructure teams to improve detection capabilities and respond to complex security incidents. The position also involves developing automation workflows, translating threat intelligence into effective detection rules, and maintaining strong security monitoring across cloud and identity platforms. This is an excellent opportunity for a security professional who enjoys hands‑on engineering, continuous improvement, and working with modern enterprise security technologies.

Accountabilities

• SIEM and SOAR Engineering: Design, deploy, and maintain log source integrations within Palo Alto Cortex XSIAM and XSOAR, ensuring accurate data normalization, parsing, and quality. Develop and continuously improve SOAR playbooks for automated incident triage, enrichment, and response. Manage detection rules, correlation policies, dashboards, and alert thresholds while optimizing detection accuracy and reducing false positives.
• Security Platform Management: Monitor SIEM platform health, connector availability, API rate limits, and log ingestion capacity. Maintain technical documentation, integration runbooks, playbook specifications, and change records in accordance with established change management procedures.
• Endpoint Security Engineering: Administer and optimize the CrowdStrike Falcon platform, including endpoint sensor deployment, security policies, and response workflows. Maintain Falcon integrations with SIEM platforms, validate endpoint detection alerts, and support incident investigations using Real Time Response (RTR) capabilities when required.
• Multi‑Cloud Security Integration: Configure and maintain security log collection across AWS, Microsoft Azure, and Google Cloud Platform. Manage integrations involving AWS GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, Azure Defender for Cloud, Azure Monitor, Entra ID, GCP Cloud Audit Logs, and Security Command Center.
• Cloud Security Monitoring: Ensure comprehensive cloud telemetry coverage aligned with security detection requirements and regulatory obligations. Identify and resolve monitoring gaps while maintaining least‑privilege IAM roles, service principals, and permissions for log collection.
• Identity and Microsoft 365 Security: Maintain and improve security integrations between Microsoft Entra ID and SIEM platforms, including Conditional Access audit logs, risky sign‑in alerts, and identity‑based detection use cases. Support Microsoft 365 Defender integrations covering Exchange Online, SharePoint, and Teams.
• Security Configuration Reviews: Assist with periodic reviews of identity security controls, including multi‑factor authentication coverage, guest account management, and privileged role assignments. Coordinate with IT teams and elevate security findings through appropriate governance channels.
• SOC Operations and Incident Response: Provide Tier 2/3 engineering support for complex security investigations, helping analysts troubleshoot incidents and improve investigation outcomes.
• Threat Detection and Continuous Improvement: Translate threat intelligence and MITRE ATT&CK tactics, techniques, and procedures into actionable detection logic. Contribute to vulnerability and configuration management activities involving SIEM‑connected assets.
• Reporting and Collaboration: Maintain accurate security monitoring metrics and contribute to weekly and monthly SOC reports. Work closely with Security Operations, IT, and infrastructure teams to improve detection capabilities, operational efficiency, and incident response processes.

Requirements

• Hands‑on experience in Security Operations, SIEM/SOAR engineering, security monitoring, or a related cybersecurity discipline.
• Strong technical expertise in SIEM and SOAR platforms, particularly Palo Alto Cortex XSIAM and XSOAR.
• Experience designing and maintaining log integrations, data parsing, normalization, detection rules, correlation policies, and automated response playbooks.
• Practical experience administering endpoint detection and response platforms, particularly CrowdStrike Falcon, including sensor management, policy configuration, and incident response.
• Strong understanding of cloud security logging and monitoring across AWS, Microsoft Azure, and Google Cloud Platform.
• Familiarity with AWS security services, including GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, EventBridge, SQS, and SNS.
• Knowledge of Azure security technologies, including Microsoft Defender for Cloud, Azure Monitor, and Microsoft Entra ID.
• Experience with GCP Cloud Audit Logs, Security Command Center, and Pub/Sub‑based logging integrations is desirable.
• Understanding of Microsoft 365 security monitoring, including Exchange Online, SharePoint, Teams, Conditional Access, and identity‑related security events.
• Knowledge of identity and access management principles, privileged access controls, MFA, and least‑privilege security practices.
• Ability to investigate complex security incidents, perform technical troubleshooting, and support Tier 2/3 SOC operations.
• Familiarity with threat intelligence, MITRE ATT&CK frameworks, and detection engineering methodologies.
• Strong documentation, analytical, problem‑solving, and communication skills.
• Ability to collaborate effectively with security analysts, IT professionals, and infrastructure engineering teams.
• Understanding of security governance, change management procedures, and regulatory compliance requirements.

Benefits

• Opportunity to work with modern enterprise cybersecurity technologies and platforms.
• Hands‑on exposure to Palo Alto Cortex XSIAM/XSOAR and CrowdStrike Falcon.
• Experience working across multi‑cloud security environments, including AWS, Azure, and GCP.
• Opportunity to contribute to advanced threat detection, automated incident response, and security engineering initiatives.
• Collaboration with international Security Operations and IT teams.
• Exposure to complex enterprise security environments and evolving cybersecurity challenges.
• Opportunities to strengthen technical expertise in SIEM, SOAR, endpoint security, cloud security, and identity protection.
• Equal employment opportunity regardless of race, gender, age, religion, disability, sexual orientation, or other legally protected characteristics.