Senior Security Architect

Interscripts, Inc.; Hyderabad; On-site; INR 2,500,000 - 4,200,000; Full time

Job summary

InterScripts is seeking an experienced Senior Security Architect with 8–10 years of hands-on cybersecurity operations, threat detection, and incident response. The role focuses on monitoring, investigations, and remediation across on-premises and cloud environments in a global IT services setting.

You will work with SIEM/EDR tools like Microsoft Sentinel, Splunk, and Defender for Endpoint, perform threat hunting, and contribute to incident playbooks and post-incident reviews.

Qualifications

• 8–10 years of hands-on cybersecurity experience in security operations or incident response.
• Experience investigating and responding to security incidents, phishing, malware, and unauthorized access.
• Hands-on with SIEM platforms (Microsoft Sentinel, Splunk, QRadar) and EDR tools (Defender for Endpoint, CrowdStrike).
• Strong knowledge of log analysis, correlation, and MITRE ATT&CK techniques.
• Familiarity with cloud security, networking, and vulnerability management.

Responsibilities

• Monitor security alerts and conduct threat detection across enterprise systems and cloud environments.
• Investigate, triage, contain, and remediate cybersecurity incidents, documenting findings.
• Tune SIEM/EDR detection rules and develop investigation tools and dashboards.
• Perform proactive threat hunting and support vulnerability identification and remediation.
• Document incident timelines, actions, and post-incident reviews; collaborate with IT teams.

Skills

Security Operations

Threat Detection

Incident Response

Log Analysis

Threat Hunting

Vulnerability Management

MITRE ATT&CK

Cloud Security

Networking Knowledge

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Microsoft Defender for Endpoint

CrowdStrike

PowerShell

Python

KQL

Job description

Kondapur, Hyderabad, India | Posted on 10/19/2026

InterScripts is a Information Technology business based in Chantilly,VA and established in 2017 providing technology and platform enabled servicesand solutions. Historically, we have enabled our customers to realize the mostvalue from their technology and resources through our Managed Services, Archival Solution, EHR,ERP, Advisory, Virtual Care, Technology, Application Development, andCybersecurity services.

In addition, InterScripts has substantial experience inproviding Technology and Platform Enabled solutions to commercial, publicsector, and government entities. We are an ISO 27001, 9001 CMMI 3 and SOC 2 certified organization, signifying our ability to lower the risks for ourclients’ application modernization efforts, custom development, support,operations, and MSP projects.

Job Description

Job Description: Senior Security Architect

Experience:8–10 Years

Work Location: Hyderabad, India – Work From Office

Employment Type: Full-Time

Shift: 5:30 PM – 2:30 AM IST

Position Overview

We are seeking an experienced Senior Security Architect with 8–10 years of hands-on experience in cybersecurity operations, security monitoring, threat detection, incident investigation, and response.

The ideal candidate will have strong technical expertise in identifying, analyzing, and responding to security incidents, investigating suspicious activities, analyzing security alerts, and supporting vulnerability remediation. This role focuses on day-to-day security operations and incident response rather than enterprise security architecture, governance, or people management.

Key Responsibilities

1. 1. Security Monitoring & Threat Detection

   Monitor security alerts, events, and suspicious activities across enterprise systems, networks, endpoints, and cloud environments.

   Analyze security events and identify potential threats, malicious activities, and indicators of compromise (IOCs).

   Investigate alerts generated by SIEM, EDR, and other security monitoring tools.

   Perform log analysis and correlate security events across multiple sources to identify potential incidents.

   Identify patterns of suspicious behavior and recommend appropriate remediation actions.

2. 2. Security Incident Response

   Investigate, triage, contain, and support the remediation of cybersecurity incidents.

   Respond to incidents involving malware, phishing, unauthorized access, compromised accounts, endpoint threats, and suspicious network activity.

   Perform root-cause analysis and document incident findings, timelines, and corrective actions.

   Collect and analyze relevant logs and security evidence to support investigations.

   Coordinate with infrastructure, network, application, and IT support teams to resolve incidents.

   Support incident recovery and post-incident reviews to help prevent recurrence.

3. 3. SIEM, EDR & Security Tools

   Work hands-on with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or similar tools.

   Use endpoint detection and response (EDR) solutions such as Microsoft Defender for Endpoint, CrowdStrike, or similar platforms.

   Investigate alerts using endpoint telemetry, authentication logs, network logs, and cloud security events.

   Develop or fine-tune detection rules, alert thresholds, and correlation logic to improve threat detection.

   Use security dashboards, queries, and investigation tools to identify and analyze potential threats.

4. 4. Threat Hunting & Vulnerability Management

   Perform proactive threat hunting to identify suspicious activities that may not trigger standard security alerts.

   Analyze indicators of compromise, threat intelligence feeds, and emerging attack techniques.

   Support vulnerability identification, prioritization, remediation tracking, and validation.

   Assist in investigating security weaknesses and recommend practical mitigation measures.

   Apply knowledge of common attack techniques, including those described in the MITRE ATT&CK framework.

5. 5. Security Operations & Documentation

   Follow established security incident response procedures, escalation processes, and service-level agreements (SLAs).

   Maintain accurate incident records, investigation notes, evidence, and remediation documentation.

   Prepare incident summaries and operational reports for relevant technical stakeholders.

   Collaborate with SOC, infrastructure, IAM, network, and application teams to strengthen day-to-day security operations.

   Participate in continuous improvement of security monitoring, incident handling, and response processes.

Requirements

8–10 years of hands-on experience in cybersecurity, security operations, SOC, threat detection, or incident response.

Strong practical experience investigating and responding to security incidents.

Hands-on experience with one or more SIEM platforms, such as Microsoft Sentinel, Splunk, or IBM QRadar.

Experience with EDR tools such as Microsoft Defender for Endpoint, CrowdStrike, or similar solutions.

Strong knowledge of security event analysis, log correlation, incident triage, and root-cause investigation.

Experience responding to phishing, malware, endpoint compromise, suspicious authentication, and unauthorized access incidents.

Working knowledge of network security, endpoint security, identity and access management, and cloud security fundamentals.

Familiarity with incident containment, eradication, recovery, and post-incident analysis.

Knowledge of common cyberattack techniques, indicators of compromise, and threat intelligence.

Understanding of vulnerability management and security remediation practices.

Strong troubleshooting, analytical, and problem-solving skills.

Good communication skills and the ability to collaborate effectively with technical teams.

Preferred Qualifications

Experience with Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, or IBM QRadar.

Familiarity with MITRE ATT&CK, threat hunting, and detection engineering.

Knowledge of incident response playbooks and digital forensics fundamentals.

Exposure to AWS, Microsoft Azure, or other cloud security monitoring tools.

Familiarity with scripting or query languages such as PowerShell, Python, KQL, or SPL.

Relevant certifications such as Security+, CySA+, GCIH, GCIA, or equivalent cybersecurity certifications.