Senior Security Engineer

InterScripts, Inc.; Kondapur; On-site; INR 3,000,000 - 5,000,000; Full time

Job summary

InterScripts, Inc. is seeking an experienced Senior Security Engineer in Hyderabad to lead cybersecurity operations. You will focus on threat detection, incident response, and proactive hunting, working hands-on with SIEM and EDR tools to protect enterprise assets.

The role emphasizes day-to-day security monitoring, incident investigation, and remediation, with collaboration across SOC, network, and IT teams to strengthen defenses.

Qualifications

• 8+ years of hands-on cybersecurity operations experience.
• Experience with SIEM investigations and incident response.
• Proficient in log correlation, threat hunting, and triage.
• Familiar with MITRE ATT&CK framework and remediation workflows.
• Strong communication and cross-team collaboration skills.

Responsibilities

• Monitor security alerts across enterprise systems, networks, endpoints, and cloud environments.
• Investigate alerts from SIEM and EDR platforms and determine incident scope.
• Perform log analysis, correlation, and root-cause investigations.
• Coordinate incident containment, remediation, and post-incident reviews.
• Develop or tune detection rules and alert thresholds for better coverage.
• Collaborate with SOC, IT, and application teams to resolve incidents.
• Maintain incident records, timelines, and evidence for stakeholders.

Skills

Security monitoring

Incident response

Threat detection

Log analysis

SIEM

EDR

Root-cause analysis

Collaboration

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Microsoft Defender for Endpoint

CrowdStrike

Cloud security monitoring

Job description

Senior Security Engineer

Experience: 8–10 Years

Work Location: Hyderabad, India – Work From Office

Employment Type: Full-Time

Shift: 5:30 PM – 2:30 AM IST

Position Overview

We are seeking an experienced Senior Security Engineer with 8+ years of hands‑on experience in cybersecurity operations, security monitoring, threat detection, incident investigation, and response.
The ideal candidate will have strong technical expertise in identifying, analyzing, and responding to security incidents, investigating suspicious activities, analyzing security alerts, and supporting vulnerability remediation. This role focuses on day‑to‑day security operations and incident response rather than enterprise security architecture, governance, or people management.

Key Responsibilities

• Security Monitoring & Threat Detection
• Monitor security alerts, events, and suspicious activities across enterprise systems, networks, endpoints, and cloud environments.
• Analyze security events and identify potential threats, malicious activities, and indicators of compromise (IOCs).
• Investigate alerts generated by SIEM, EDR, and other security monitoring tools.
• Perform log analysis and correlate security events across multiple sources to identify potential incidents.
• Identify patterns of suspicious behavior and recommend appropriate remediation actions.
• Investigate, triage, contain, and support the remediation of cybersecurity incidents.
• Respond to incidents involving malware, phishing, unauthorized access, compromised accounts, endpoint threats, and suspicious network activity.
• Perform root-cause analysis and document incident findings, timelines, and corrective actions.
• Collect and analyze relevant logs and security evidence to support investigations.
• Coordinate with infrastructure, network, application, and IT support teams to resolve incidents.
• Support incident recovery and post-incident reviews to help prevent recurrence.
• Work hands‑on with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or similar tools.
• Use endpoint detection and response (EDR) solutions such as Microsoft Defender for Endpoint, CrowdStrike, or similar platforms.
• Investigate alerts using endpoint telemetry, authentication logs, network logs, and cloud security events.
• Develop or fine‑tune detection rules, alert thresholds, and correlation logic to improve threat detection.
• Use security dashboards, queries, and investigation tools to identify and analyze potential threats.
• Perform proactive threat hunting to identify suspicious activities that may not trigger standard security alerts.
• Analyze indicators of compromise, threat intelligence feeds, and emerging attack techniques.
• Support vulnerability identification, prioritization, remediation tracking, and validation.
• Assist in investigating security weaknesses and recommend practical mitigation measures.
• Apply knowledge of common attack techniques, including those described in the MITRE ATT&CK framework.
• Follow established security incident response procedures, escalation processes, and service-level agreements (SLAs).
• Maintain accurate incident records, investigation notes, evidence, and remediation documentation.
• Prepare incident summaries and operational reports for relevant technical stakeholders.
• Collaborate with SOC, infrastructure, IAM, network, and application teams to strengthen day‑to‑day security operations.
• Participate in continuous improvement of security monitoring, incident handling, and response processes.

Requirements

• 8+ years of hands‑on experience in cybersecurity, security operations, SOC, threat detection, or incident response.
• Strong practical experience investigating and responding to security incidents.
• Hands‑on experience with one or more SIEM platforms, such as Microsoft Sentinel, Splunk, or IBM QRadar.
• Experience with EDR tools such as Microsoft Defender for Endpoint, CrowdStrike, or similar solutions.
• Strong knowledge of security event analysis, log correlation, incident triage, and root-cause investigation.
• Experience responding to phishing, malware, endpoint compromise, suspicious authentication, and unauthorized access incidents.
• Working knowledge of network security, endpoint security, identity and access management, and cloud security fundamentals.
• Familiarity with incident containment, eradication, recovery, and post‑incident analysis.
• Knowledge of common cyberattack techniques, indicators of compromise, and threat intelligence.
• Understanding of vulnerability management and security remediation practices.
• Strong troubleshooting, analytical, and problem‑solving skills.
• Good communication skills and the ability to collaborate effectively with technical teams.

Preferred Qualifications

• Experience with Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, or IBM QRadar.
• Familiarity with MITRE ATT&CK, threat hunting, and detection engineering.
• Knowledge of incident response playbooks and digital forensics fundamentals.
• Exposure to AWS, Microsoft Azure, or other cloud security monitoring tools.
• Familiarity with scripting or query languages such as PowerShell, Python, KQL, or SPL.
• Relevant certifications such as Security+, CySA+, GCIH, GCIA, or equivalent cybersecurity certifications.