Senior Analyst - SOC

GRAMAX; Gurugram District; On-site; INR 1,500,000 - 2,200,000; Full time

Job summary

GRAMAX is seeking a skilled Cyber Security professional to monitor security alerts, investigate incidents, and lead containment and remediation efforts for global clients. You will work with leading SIEM/XDR technologies to detect, analyze, and respond to complex threats.

The role requires hands-on experience in malware analysis, RCA, and threat intelligence, with the ability to guide junior analysts and coordinate with cross-functional teams during high-severity incidents.

Qualifications

• Experience in security incident management and response processes.
• Knowledge of network security, threat detection and security operations.
• Ability to communicate with clients and coordinate remediation efforts.

Responsibilities

• Continuously monitor security alerts and respond to incidents per Run Book.
• Provide incident investigation as per Security Incident Management Process.
• Drive containment strategy during data loss or breach events.
• Triage and resolve advanced vector attacks such as botnets and APTs.
• Perform investigations, gather evidence and determine RCA of security incidents.
• Coordinate with IT, security operations and other teams for remediation.

Skills

Incident response

Threat hunting

Malware analysis

Root Cause Analysis

Threat intelligence

Tools

QRadar

Splunk

ArcSight

Seceon

Job description

Department / Sub-Department: Cyber Security

1. Key Accountabilities

Responsibilities/duties associated with the job. Where defined, the Key Performance Indicator (KPI) used to judge performance is listed beneath the accountability.

• Continuous monitoring of security alerts and respond to the incidents as per the laid down actions of Run Book
• Provide incident investigation as per Security Incident Management Process / Guidelines
• Drive containment strategy during data loss or breach events
• Triage and resolve advanced vector attacks such as botnets and Advanced Persistent Threats (APTs)
• Perform investigations in response to escalated security alerts, gather evidence and determine RCA of the security incident
• Plan for adversary eviction and incident response
• Conduct malware analysis; maintain up-to-date knowledge of malware analysis techniques
• Provide inputs for forensic analysis and investigation of incidents
• Carry out continuous threat collection and proactively identify threats for global clients to complement the standard SOC
• Identify requirements and drive appropriate solutions
• Create customized use cases as per the environment and fine-tune the security solution
• Provide guidance to member analysts in the team
• Contribute to identification (hunting) and profiling of threat actors and TTPs; detect current threats and build/run custom analysis models using security event data
• Ensure integration of current security infrastructure and indicators
• Assist in development of the Threat Hunting service and conduct threat hunting
• Execute the incident management process
• Handle customer interactions and on-site engagements
• Align weekly/fortnightly reviews with client and Sr. Security Delivery Manager
• Work with XDR and SIEM solutions such as QRadar, Seceon, ArcSight, Splunk, etc.
• Coordinate with IT, security operations and other teams for remediation and mitigation as appropriate
• Perform Root Cause Analysis (RCA) for incidents and update the knowledge document
• Handle incident escalations from other analysts; project and manage incident responses and coordinate remediation with customers
• Create SOPs for L1 and L2 Incident Response processes
• Train L1/L2 analysts on advanced threat analysis and APT analysis using various tools
• Perform in-depth malware analysis of network activity, disks and memory
• Analyze threat and vulnerability alerts, determine current impact and coordinate remediation actions as necessary
• Conduct detailed analysis using a variety of tools and techniques to investigate, navigate, correlate and understand security incidents
• Work directly with data asset owners and business response plan owners during high-severity incidents
• Provide fine-tuning recommendations to administrators based on findings during investigations or threat information reviews
• Maintain knowledge of network security zones, firewall configurations and IDS policies
• Maintain knowledge of systems communications from Layer 1 to Layer 7
• Bring experience in Systems Administration, Middleware and Application Administration
• Bring experience with Network and Network Security tools administration
• Aggregate and parse log data (syslog, HTTP logs, DB logs) for investigation purposes
• Use log search tools with regular expressions and natural language queries