Senior Information Security Analyst

Colonial Group; Bengaluru; On-site; INR 1,800,000 - 2,800,000; Full time

Job summary

Colonial Group is seeking a Senior SOC Level 3 Analyst to lead complex security investigations and drive monitoring maturity in Bangalore. You will mentor junior team members, coordinate with cross-functional teams, and oversee threat hunting and vulnerability lifecycle management.

The role requires deep expertise in security operations, incident response, and cloud security, with a proven track record in advanced threat detection and risk remediation.

Qualifications

• 5–6 years of experience in Cyber Security and SOC.
• Experience with incident response and vulnerability management.
• Strong knowledge of network security fundamentals and cloud security.

Responsibilities

• Act as a higher technical escalation point for complex security incidents and threat investigations.
• Lead end-to-end investigation and response activities for major cyber incidents, including APTs, ransomware, insider threats, and cloud security incidents.
• Provide expert guidance and mentorship to Level 1 and Level 2 analysts.
• Coordinate incident response activities with internal and external stakeholders.
• Conduct advanced threat hunting using SIEM, EDR, UBA and network monitoring platforms.
• Review detection logic and enhance monitoring use cases to improve SOC effectiveness.
• Own and manage the enterprise Vulnerability Management Program and remediation lifecycle.
• Collaborate with infrastructure, application and cloud teams to prioritize remediation by risk.
• Lead vulnerability review meetings and remediation governance forums.
• Lead post-incident reviews and translate lessons learned into improvements.
• Lead the creation, update and maintenance of group standards, playbooks and runbooks.

Skills

Cyber Security

Security Operations

Incident Response

Threat Hunting

Vulnerability Management

SOC processes

Tools

Rapid7 InsightVM

Rapid7 InsightIDR

Rapid7 Threat Command

Darktrace

Mimecast

Forcepoint

Varonis

Beyond Trust

Microsoft Defender Suite

ServiceNow

CrowdStrike

Palo Alto Technologies

Azure Security Centre

Job description

Job Description

Job Title: IT Information Security – Level 3 Security Analyst

Department: IT Security

Line Manager’s Job Title: IT Security Operations Manager

Location: Bangalore

Version Date: 20/07/2026

The Level 3 Security Specialist is one of the most senior technical security positions within the OSB Security Operations Centre (SOC). The role serves as the primary technical escalation point for complex cyber security incidents, advanced threat detection, vulnerability management, and security monitoring operations.

The L3 Security Specialist is responsible for driving the maturity of the SOC by leading major incident investigations, enhancing detection capabilities, overseeing vulnerability management processes, and ensuring the organization maintains a strong security posture against evolving cyber threats.

The role requires extensive experience in Security Operations, Incident Response, Threat Hunting, Vulnerability Management, and Security Engineering. The successful candidate will provide technical leadership across the SOC, mentor junior analysts, influence security strategy, and work closely with infrastructure, application, cloud, and risk teams to drive remediation of identified security risks.

What you will be responsible for:

As a SOC Level 3 Analyst you will:

• Act as a higher technical escalation point for complex security incidents and threat investigations.
• Lead end-to-end investigation and response activities for major cyber incidents, including Advanced Persistent Threats (APT), ransomware, insider threats, phishing campaigns, and cloud security incidents.
• Provide expert guidance and mentorship to Level 1 and Level 2analysts.
• Coordinate incident response activities with internal and external stakeholders.
• Conduct advanced threat hunting activities using SIEM, Endpoint Detection & Response (EDR), User Behaviour Analytics (UBA), and network monitoring platforms.
• Review detection logic and continuously enhance monitoring use cases to improve SOC effectiveness.
• Act as the point of escalation for deep-dive incident analysis, determining if critical systems or data sets has been impacted.
• Own and manage the enterprise Vulnerability Management Program.
• Drive vulnerability lifecycle management from identification through remediation and validation.
• Collaborate with infrastructure, application, cloud, and business teams to prioritize vulnerability remediation based on Exploitable vulnerabilities and business impact.
• Lead vulnerability review meetings and remediation governance forums.
• Conduct research on emerging threats in support of security enhancement and development efforts; recommend security improvements, upgrades.
• Lead post-incident reviews and ensure lessons learned are translated into actionable improvements.
• Lead the creation, update and maintenance of the group standards, playbooks and runbooks.

Key Knowledge and abilities include

• 5–6 years of experience in Cyber Security, Security Operations, Incident Response, Threat Hunting, and Vulnerability Management.
• Advanced knowledge of Security Operations Centre (SOC) processes and technologies.
• Expert in the use of SIEM Services, User Behaviour tools, Data Loss Prevention, email gateway
• Advanced knowledge of network security concepts including:
• Firewalls
• IDS/IPS
• VLANs
• Network segmentation
• Network traffic analysis
• Detailed Knowledge of targeted cyber-attack (APT), how to analysis these and respond to and mitigate against the attacks is essential.
• Excellent knowledge and experience with information security frameworks and concepts, trends and practices.
• Strong knowledge of Microsoft Azure Security.
• Experience with Microsoft Defender Suite.
• Experience with Microsoft 365 Security Services.
• Strong threat hunting and forensic investigation capabilities.
• Experience reviewing Indicators of Compromise (IOCs) and Indicators of Attack (IOAs).
• Proficient with Vulnerability Remediation tools / activities
• Experience with work-flow management tools such as ServiceNow is essential.
• Leveraging creative thinking and problem-solving skills, individual initiative, and utilizing MS Office (Word, Excel, Access, and PowerPoint).
• Demonstrated ability to collaborate with technology teams.
• Proven mentoring and coaching experience.

Preferred Tools Experience

• Rapid7 InsightVM (Essential)
• Rapid7 InsightIDR
• Rapid 7 Threat Command
• Darktrace
• Mimecast
• Forcepoint
• Varonis
• Beyond trust
• Microsoft Defender Suite
• ServiceNow
• CrowdStrike
• Palo Alto Technologies
• Azure Security Centre

Education & Preferred Qualifications

Preferred Certifications (One or more of the following)

• CompTIA Security+
• CompTIA CySA+
• Microsoft Security Certifications
• Rapid7 InsightVM Certification (Preferred)
• Certified Ethical Hacker (CEH)
• SC-200 Microsoft Security Operations Analyst

Between 7-8 years in progressive IT and cyber security experience