Security Operations Center

Apollo Hospitals; Chennai; On-site; INR 900,000 - 1,300,000; Full time

Job summary

Apollo Hospitals in Chennai seeks a skilled SOC Analyst to monitor and protect the enterprise IT landscape across 50+ hospitals. You will operate in a 24x7 SOC, triage events, and drive incident response in real time.

You will implement detection rules, coordinate with IT teams and OEMs, and contribute to threat hunting and awareness campaigns. Prior hands-on experience with SIEM platforms and EDR is required.

Qualifications

• Hands-on with SIEM platforms: Microsoft Sentinel, Splunk, QRadar, ArcSight.
• Working knowledge of EDR (SentinelOne preferred), WAF, DLP and email security.
• Understanding of MITRE ATT&CK framework and common attack patterns.
• Strong networking fundamentals (TCP/IP, DNS, HTTP) and OS basics (Windows/Linux).

Responsibilities

• Monitor SIEM/EDR/WAF/email security for events during shift.
• Triage alerts, analyze, enrich indicators, classify true/false positives.
• Execute playbooks for phishing, malware, brute force, data exfiltration.
• Escalate incidents per workflow to L2/L3 and incident commander.
• Coordinate with hospital IT teams and OEMs for containment.
• Own end-to-end incident handling at L2, incl. root cause & forensics.
• Develop and tune detection use cases and playbooks with SOC engineers.
• Ensure 100% uptime of SOC tooling and report platform issues.
• Onboard new log sources; validate parsing, retention and detection.
• Generate shift summaries, dashboards and management metrics.
• Participate in threat hunting and purple team drills.
• Maintain case management documentation hygiene.
• Contribute to awareness campaigns and phishing simulations.

Skills

SOC operations

Incident triage

Threat hunting

Analytical mindset

Shift work

Education

CompTIA Security+

CySA+

GCIA

GCIH

SC-200

Tools

Microsoft Sentinel

Splunk

QRadar

ArcSight

SentinelOne

CrowdStrike

Defender

Job description

The Apollo Hospitals Family

Set-up in 1983 by Dr. Prathap C. Reddy, renowned as the architect of modern healthcare in India. As the nations first corporate hospital, Apollo Hospitals is acclaimed for pioneering the private healthcare revolution in the country.

Apollo Hospitals has emerged as Asia’s foremost integrated healthcare services provider and has a robust presence across the healthcare ecosystem, including Hospitals, Pharmacies, Primary Care & Diagnostic Clinics and several retail health models. The cornerstones of Apollo’s legacy are its unstinting focus on clinical excellence, affordable costs, modern technology and forward-looking research & academics.

Role Description

The SOC Analyst operates Apollo's 24x7 Security Operations Centre, responsible for real-time monitoring, triage, analysis and response to cybersecurity events across the enterprise IT landscape. Operating in a three-shift plus reliever model, the analyst ensures 100% uptime of SOC tooling, drives reduction in false positives, integrates new log sources and maintains strict adherence to incident response SLAs. The role is central to operationalising the Cyber Security Vision 2.0 and to safeguarding 50+ hospitals, their clinical systems and patient data.

Detailed Job Responsibility & Accountabilities

• Monitor SIEM, EDR, NDR, WAF, email security and identity protection consoles for security events during assigned shift.
• Triage alerts, perform initial analysis, enrich indicators and determine true-positive vs false-positive classification.
• Execute defined playbooks for common incident types (phishing, malware, brute force, data exfiltration attempts).
• Escalate confirmed incidents to L2/L3 and incident commander per incident response workflow.
• Coordinate with local hospital IT teams and OEMs for incident analysis, containment and remediation.
• At L2 level, own end-to-end incident handling, root cause analysis, forensic data collection and closure within SLA.
• Develop and tune detection use cases, correlation rules and playbooks in partnership with SOC engineering.
• Ensure 100% uptime of SOC tooling; raise and track any platform issues to OEMs.
• Integrate new log sources per the onboarding plan; validate parsing, retention and detection coverage.
• Generate shift summary reports, executive dashboards and metrics for management review.
• Participate in threat hunting exercises and purple team drills.
• Maintain strict documentation hygiene in case management and ticketing tools.
• Contribute to awareness campaigns and phishing simulation exercises.

Desired Skills & Competencies

• L1: 2+ years, L2: 5+ years of SOC / security operations experience.
• Must have hands-on experience with leading SIEM platforms (Microsoft Sentinel, Splunk, QRadar, ArcSight).
• Must have working knowledge of EDR (SentinelOne preferred, CrowdStrike, Defender), WAF, DLP and email security platforms.
• Must have understanding of MITRE ATT&CK framework, common attack patterns and threat actor TTPs.
• Must have strong networking fundamentals (TCP/IP, DNS, HTTP, proxies) and operating system basics (Windows, Linux).
• Must have analytical mindset and ability to triage alerts quickly and accurately.
• Preferred certifications: CompTIA Security+, CySA+, GCIA, GCIH, SC-200, or equivalent.
• Comfort with rotating shift schedules (3-shift + reliever model) is essential.

Job Performance Parameters

• 100% uptime of SOC tooling
• Reduction in false positive incident rate
• SLA adherence for alert triage, investigation and escalation
• Log source integration completion per plan
• Mean Time to Detect and Mean Time to Respond |
• Quality of shift summary and incident documentation

Managerial and Behavioral Competencies

• Attention to detail and analytical rigour
• Calm under pressure
• Team Spirit and shift collaboration
• Effective Communication during incidents

Continuous learning on evolving threats