Senior Security Analyst

Access Healthcare Service; Chennai District; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Access Healthcare Service is seeking an experienced Security Analyst (Tier 2) to join our SOC. You will detect, investigate, and respond to cybersecurity incidents across a large enterprise environment, coordinating with IT and engineering teams.

You will manage SIEM, SOC processes, develop detection rules, and automate triage with SOAR. Strong hands-on experience with SIEM/EDR tools and relevant certifications are preferred.

Qualifications

• Minimum 5 years in a SOC / Security Operations environment.
• Hands-on experience with SIEM tools (Splunk, Microsoft Sentinel, QRadar).
• Experience with EDR platforms (CrowdStrike Falcon, Defender, SentinelOne, Cortex XDR).
• Relevant certifications such as CEH, CHFI, COMPTIA+, GCIA, GCIH.
• Knowledge of MITRE ATT&CK framework and threat intelligence.

Responsibilities

• Manage and maintain the SIEM platform—log ingestion health and rules accuracy.
• Lead Tier 2 incident response activities—contain, eradicate, recover per playbook.
• Document investigations and actions in ITSM systems (ServiceNow, Jira).
• Develop and tune detection rules, correlations, and dashboards.
• Onboard missing log sources with IT and infrastructure teams.
• Automate triage tasks via SOAR playbooks to improve efficiency.
• Monitor endpoint telemetry with EDR platforms to detect malware and L0/LotL activity.
• Analyze firewall logs and network traffic to identify threats.
• Investigate alerts from IDS/IPS, proxies, DNS security, and NDR.
• Track active threat campaigns and CVEs relevant to the stack.
• Collaborate with IT and engineering on threat remediation.

Skills

Incident response

Threat analysis

Log analysis

MITRE ATT&CK knowledge

Education

Bachelor's degree in Cyber Security

Bachelor's degree in Computer Science

Tools

Splunk

Microsoft Sentinel

QRadar

CrowdStrike Falcon

Microsoft Defender

SentinelOne

Cortex XSOAR

Job description

We are seeking an experienced Security Analyst (Tier 2) to join our Security Operations Center (SOC) team. The successful candidate will serve as a subject matter expert in enterprise security monitoring, responsible for the detection, investigation, and response to cybersecurity incidents and threats across a large-scale, complex enterprise environment.

Key Responsibilities:

Manage and maintain the SIEM platform — ensuring log ingestion health, data source onboarding, parser validation, and rule accuracy.

Lead and coordinate Tier 2 incident response activities — containing, eradicating, and recovering from security incidents in line with the SOC IR playbook and defined SLAs.

Document all investigation steps, findings, evidence, and actions taken accurately within the ITSM / ticketing system (e.g. ServiceNow, Jira).

Perform root cause analysis (RCA) on significant incidents and contribute lessons learned to post-incident review reports.

Develop, tune, and maintain detection rules, correlation rules, and dashboards to improve coverage across the MITRE ATT&CK framework.

Identify log source gaps and work with IT and infrastructure teams to onboard missing data sources into the SIEM.

Automate repetitive triage tasks through SOAR playbooks (e.g. Cortex XSOAR, Sentinel Logic Apps) to improve analyst efficiency and reduce MTTD/MTTR.

Monitor and investigate endpoint telemetry using EDR platforms (e.g. CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne) to detect malicious activity including malware, ransomware, and livingoff-the-land (LotL) attacks.

Analyse firewall logs and network traffic data (Palo Alto, FortiGate, Cisco ASA, Check Point) to identify suspicious traffic patterns, policy violations, and network-based threats.

Investigate alerts originating from IDS/IPS systems, web proxies, DNS security platforms, and network detection and response (NDR) solutions

Consume and operationalize threat intelligence feeds (commercial and open-source) — triaging IOCs, enriching alerts, and updating blocking lists in SIEM, firewall, and EDR platforms.

Track active threat campaigns, adversary groups, and CVEs relevant to the organization’s sector and technology stack.

Collaborate with IT, infrastructure, and engineering teams on threat remediation

Job requirements:

Minimum 5 years in a SOC / Security Operations environment

Qualifications:

Any degree in information technology specialization in Cyber Security/ Forensic, computer science, Information Technology

5-7 years of experience working in a 24x7 Security Operation Center (SOC) environment.

Hands-on experience working with any of the SIEM tools (Splunk, Microsoft Sentinel, or QRadar)

EDR expertise (CrowdStrike Falcon, Microsoft Defender, SentinelOne, or Cortex XDR)

Relevant certifications such as CEH, CHFI, COMPTIA +,GCIA, GCIH, Splunk, Elastic, Microsoft Sentinel, QRadar, or equivalent.

Work type:

Full-time, Permanent