Senior Analyst - SOC

Gramax; Delhi; On-site; INR 600,000 - 900,000; Full time

Job summary

Gramax is seeking a Sr. Analyst – SOC in Delhi to monitor security alerts, investigate incidents, and support containment and remediation across global clients. You will work with XDR and SIEM tools such as QRadar, Splunk, ArcSight, Seceon, and assist in incident response.

The role requires hands-on malware analysis, threat hunting, and creation of run books, SOPs, and use cases. You will guide junior analysts, coordinate with IT and security teams, and maintain up-to-date knowledge of threats

Responsibilities

• Continuous monitoring of security alerts and respond to incidents per Run Book.
• Provide incident investigation per Security Incident Management Process.
• Drive containment strategy during data loss or breach events.
• Triage and resolve advanced vector attacks such as botnets and APTs.
• Perform investigations, gather evidence and determine RCA of incidents.
• Plan for adversary eviction and incident response.
• Conduct malware analysis; keep up-to-date with analysis techniques.
• Provide inputs for forensic analysis and investigation of incidents.
• Carry out threat collection and identify threats for global clients.
• Create customized use cases and fine-tune security solution.
• Provide guidance to analysts in the team.
• Create SOPs and run books; train L1/L2 analysts on advanced threat analysis.
• Improve integration of security infrastructure and indicators.
• Assist in developing Threat Hunting service and conduct threat hunting.
• Execute incident management process and coordinate remediation with customers.
• Prepare knowledge documents and RCA reports.
• Coordinate with IT and security teams for remediation actions.
• Maintain knowledge of network security zones and IDS policies.
• Aggregate and parse log data for investigation purposes.
• Use log search tools with regex and natural language queries

Job description

Position Title: Sr. Analyst – SOC

Business / Function: GRAMAX Cybertech

Department / Sub-Department: Cyber Security

Location: Delhi

1. Key Accountabilities

Responsibilities/duties associated with the job. Where defined, the Key Performance Indicator (KPI) used to judge performance is listed beneath the accountability.

• Continuous monitoring of security alerts and respond to the incidents as per the laid down actions of Run Book
• Provide incident investigation as per Security Incident Management Process / Guidelines
• Drive containment strategy during data loss or breach events
• Triage and resolve advanced vector attacks such as botnets and Advanced Persistent Threats (APTs)
• Perform investigations in response to escalated security alerts, gather evidence and determine RCA of the security incident
• Plan for adversary eviction and incident response
• Conduct malware analysis; maintain up-to-date knowledge of malware analysis techniques
• Provide inputs for forensic analysis and investigation of incidents
• Carry out continuous threat collection and proactively identify threats for global clients to complement the standard SOC
• Identify requirements and drive appropriate solutions
• Create customized use cases as per the environment and fine-tune the security solution
• Provide guidance to member analysts in the team
• Create technical documentation (SOPs, run books, etc.)
• Contribute to identification (hunting) and profiling of threat actors and TTPs; detect current threats and build/run custom analysis models using security event data
• Ensure integration of current security infrastructure and indicators
• Assist in development of the Threat Hunting service and conduct threat hunting
• Execute the incident management process
• Handle customer interactions and on-site engagements
• Align weekly/fortnightly reviews with client and Sr. Security Delivery Manager
• Work with XDR and SIEM solutions such as QRadar, Seceon, ArcSight, Splunk, etc.
• Coordinate with IT, security operations and other teams for remediation and mitigation as appropriate
• Perform Root Cause Analysis (RCA) for incidents and update the knowledge document
• Handle incident escalations from other analysts; project and manage incident responses and coordinate remediation with customers
• Create SOPs for L1 and L2 Incident Response processes
• Train L1/L2 analysts on advanced threat analysis and APT analysis using various tools
• Perform in-depth malware analysis of network activity, disks and memory
• Analyze threat and vulnerability alerts, determine current impact and coordinate remediation actions as necessary
• Conduct detailed analysis using a variety of tools and techniques to investigate, navigate, correlate and understand security incidents
• Work directly with data asset owners and business response plan owners during high-severity incidents
• Provide fine-tuning recommendations to administrators based on findings during investigations or threat information reviews
• Maintain knowledge of network security zones, firewall configurations and IDS policies
• Maintain knowledge of systems communications from Layer 1 to Layer 7
• Bring experience in Systems Administration, Middleware and Application Administration
• Bring experience with Network and Network Security tools administration
• Aggregate and parse log data (syslog, HTTP logs, DB logs) for investigation purposes
• Use log search tools with regular expressions and natural language queries