Security Operations Engineer

NextGenEnergyJobs; Bengaluru; On-site; INR 2,500,000 - 5,200,000; Full time

Benefits offered by this job

Flexible time off

Wellness resources

Team events

Job summary

NextGenEnergyJobs in Bengaluru seeks an experienced security professional to design detections and response workflows. You will partner with the security operations team to identify real attacks and data loss events with speed and confidence.

The role focuses on high-signal detections, rapid containment, and improving operational efficiency across the environment, leveraging Splunk and SIEM tooling.

Qualifications

• 6+ years of experience in cybersecurity or related field.
• 3+ years in incident response, detection engineering, security operations, or SIEM engineering.
• Strong hands-on experience with a SIEM platform; Splunk preferred.
• Solid understanding of incident response lifecycle and cloud/security basics.
• Ability to write scripts and automate tasks with Python.
• Experience with APIs and data source integration.
• Excellent written and verbal communication, cross-team collaboration.
• Bachelor’s degree in a related technical field and exposure to SIEM/SOAR tools.

Responsibilities

• Partner with security operations to develop and mature use cases across the company.
• Build detections, policies, and response logic for real attacks and data loss events.
• Focus on signal quality, faster containment, and operational improvement.
• Develop high-signal detections for credential misuse, privilege abuse, and cloud risk.
• Create risk-informed detections using identity context and threat intel.
• Design response workflows to reduce manual effort during investigations.
• Drive a detection program oriented to prevention and earlier detection.

Skills

Incident response

Detection engineering

SOAR

Python scripting

APIs

Analytical thinking

Communication

Education

Bachelor’s degree in Computer Science/Info Security/Engineering

Tools

Splunk

Tines

XSOAR

EDR tools

Job description

And because we understand the value of bringing your full and best self to work, we offer a variety of perks to manage a healthy balance, including flexible time off, wellness resources, and company-sponsored team events.

Key Responsibilities

• You will partner with the security operations lead and broader security team to develop and mature security use cases that apply across the company’s environment and operations. Your mission is to build and refine the detections, policies, and response logic that enable the team to identify real attacks, misuse, intrusions, and data loss events with speed and confidence.
• This is not a passive monitoring role. You will be expected to understand how the business operates, how attackers move, where meaningful signals live, and how to translate that knowledge into durable security content and response workflows. Success in this role is measured not by alert volume, but by signal quality, attack reduction, faster containment, and continuous operational improvement .
• High-signal detections for credential misuse, privilege abuse, lateral movement, endpoint compromise, cloud and SaaS misuse, suspicious administrative activity, insider risk indicators, and sensitive data movement.
• Risk-informed detections that combine activity with identity context, asset criticality, exposure data, vulnerability posture, and threat intelligence .
• Response workflows that reduce manual effort and improve speed, consistency, and quality during investigations.
• A detection program that focuses on real outcomes : prevention, earlier detection, faster containment, and reduced operational noise.

Requirements

• 6+ years of experience in cybersecurity, or a related technical field
• 3+ years of hands-on experience in incident response, detection engineering, security operations, or SIEM engineering
• Strong hands-on experience with a SIEM platform; direct experience with Splunk is strongly preferred
• Solid understanding of the incident response lifecycle, including triage, scoping, containment, eradication, recovery, and post-incident learning
• Strong understanding of foundational networking, systems, cloud, and security principles
• Ability to write scripts and automate tasks using Python or a similar language
• Ability to work with APIs, integrate data sources, and automate enrichment or response actions
• Strong analytical thinking and the ability to translate ambiguous threats or operational gaps into concrete detection logic
• Excellent written and verbal communication skills, with the ability to collaborate effectively across technical and non-technical teams
• Bachelor’s degree in Computer Science, Information Security, Engineering, or a related technical field
• Exposure to SIEMs (e.g., Splunk) or SOAR platforms (e.g., Tines, XSOAR)
• Experience with SOC technologies such as IDS/IPS, UTM firewalls, EDR, anti-virus, network-based threat detection, and netflow.
• Familiarity with software development practices and secure coding principles
• Experience with cloud-native monitoring (e.g., AWS Config, CloudTrail, Audit Logs)
• Security certifications: GCIH, AWS Security Specialty, or equivalent
• We are primarily an in-office environment and therefore, you will be expected to work from the Bangalore office in compliance with Everpure's policies, unless you are on PTO, or work travel, or other approved leave.