SOC Analyst

Reward360; Bengaluru; On-site; INR 900,000 - 1,400,000; Full time

Job summary

Reward360 Global Services is expanding its dedicated SOC to serve major BFSI clients with 24x7 detection, triage, and incident response across EDR/XDR stacks. The role emphasizes regulatory compliance with PCI DSS, RBI frameworks, and DPDP, while maintaining strong forensic integrity and collaboration with bank SLAs.

The ideal candidate has hands-on SOC experience in regulated environments, familiarity with CrowdStrike/SentinelOne, and strong MITRE ATT&CK knowledge to drive detections and

Qualifications

• Bachelor's degree in computer science, IT, or a related field.
• 2-3 years of hands-on SOC / blue-team experience, ideally within BFSI, fintech, or another regulated environment.
• Working expertise with at least one EDR/XDR platform; CrowdStrike Falcon and/or SentinelOne Singularity strongly preferred.
• Solid grounding in the MITRE ATT&CK framework, cyber kill chain analysis, and BFSI threat-actor TTPs.
• Familiarity with SIEM platforms (Splunk / QRadar / Microsoft Sentinel / ELK) for cross-source log correlation.
• Working knowledge of PCI DSS v4.0.1, RBI Cyber Security Framework, and DPDP Act 2023 fundamentals.
• Comfort with Windows and Linux internals, core network protocols (TCP/IP, DNS, HTTP/S), and common attack vectors.
• Scripting/automation ability (Python or PowerShell) for detection engineering or SOAR playbook development is a strong plus.
• Familiarity with building internal SOC tools and Agentic automation

Responsibilities

• 24x7 detection monitoring across endpoint, cloud workload, and identity detections for production and UAT estates.
• Maintain client-segmented visibility and SLA adherence for bank-linked environments.
• Perform L1/L2 alert triage and investigation, mapping to MITRE ATT&CK tactics/techniques.
• Tune detection rules to reduce false positives while maintaining coverage.
• Escalate incidents per the SOC escalation matrix with clear severity and business impact.
• Execute containment, eradication, and recovery actions using EDR and preserve chain-of-custody.
• Support regulatory reporting and RBIs/CERT-In obligations.
• Document runbooks, playbooks, and mentor SOC interns on triage and escalation

Skills

SOC experience

MITRE ATT&CK framework

Incident response

Communication

Scripting/automation

Education

Bachelor's degree in CS/IT

Tools

CrowdStrike Falcon

SentinelOne Singularity

Splunk

QRadar

Microsoft Sentinel

ELK

Job description

About the Role

Reward360 Global Services (R360) operates a banking loyalty and rewards platform integrated with major Indian and international banks, including HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. As R360 stands up a dedicated inhouse Security Operations Centre (SOC), the Permanent SOC Analyst will be a frontline defender for production environments serving these regulated banking clients, delivering 24x7 detection, triage, and incident response across our EDR/XDR stack, while maintaining strict compliance with PCI DSS v4.0.1, the RBI Cyber Security Framework, and the DPDP Act 2023.

Key Responsibilities

1. 24x7 Detection Monitoring

• Monitor CrowdStrike Falcon, SentinelOne , PIM,PAM, and DAM Singularity consoles for endpoint, cloud workload, and identity-based threat detections across production and UAT estates.
• Maintain client-segmented visibility and SLA adherence for HDFC, ICICI, and Kotak-linked environments in line with each banks InfoSec SLA and contractual security addenda.

2. Triage, Investigation Escalation

• Perform L1/L2 alert triage and investigation, mapping detections to MITRE ATTCK tactics/techniques.
• Tune detection rules (custom IOAs in CrowdStrike, Deep Visibility / STAR rules in SentinelOne) to reduce false positives without eroding coverage.
• Escalate confirmed incidents per the SOC escalation matrix, with clear severity classification and business-impact framing.

3. Incident Response

• Execute containment, eradication, and recovery actions using EDR host-isolation and remediation capability.
• Preserve chain-of-custody and forensic integrity for evidence supporting internal investigations and, where required, regulator/bank-facing reporting. Support incident timelines aligned to RBIs cyber-incident reporting mandate and CERT-In reporting obligations.

4. Threat Hunting Detection Engineering

• Run hypothesis-driven threat hunts across endpoint telemetry, prioritizing BFSI-targeted TTPs (banking trojans, ATM/POS malware families, phishing-to-RAT chains, credential-harvesting campaigns).
• Correlate EDR telemetry with SIEM, AWS WAF, CloudTrail, and application logs to reconstruct crossenvironment attack chains.

5. Compliance, Audit Change Support

• Provide InfoSec sign-off inputs for change requests (PCCB) impacting SOC-monitored assets, where applicable.
• Support PCI DSS QSA assessments, ISO 27001 audits, and bank-specific annual vendor security reviews with SOC tooling evidence (alert logs, detection coverage reports, response-time metrics).

6. Documentation Mentorship

• Maintain shift handover notes, SOC playbooks, and runbooks; contribute to continuous improvement of detection use cases.
• Mentor SOC interns on triage methodology, tool usage, and escalation discipline.

Required Qualifications

• Bachelors degree in computer science, IT, or a related field (or equivalent practical experience).
• 2-3 years of hands-on SOC / blue-team experience, ideally within BFSI, fintech, or another regulated environment.
• Working expertise with at least one EDR/XDR/ platform, incident responder; CrowdStrike Falcon and/or SentinelOne Singularity strongly preferred.
• Solid grounding in the MITRE ATTCK framework, cyber kill chain analysis, and common BFSI threat-actor TTPs.
• Familiarity with SIEM platforms (Splunk / QRadar / Microsoft Sentinel / ELK) for cross-source log correlation.
• Working knowledge of PCI DSS v4.0.1 (particularly Requirements 10, 11, and 12), the RBI Cyber Security Framework, and DPDP Act 2023 fundamentals.
• Comfort with Windows and Linux internals, core network protocols (TCP/IP, DNS, HTTP/S), and common attack vectors.
• Scripting/automation ability (Python or PowerShell) for detection engineering or SOAR playbook development is a strong plus.
• Familiarity with building internal SOC tools and Agentic automation

Preferred Certifications

• CompTIA Security+ / CySA+
• CrowdStrike Certified Falcon Administrator (CCFA) or Responder (CCFR) CEH (Certified Ethical Hacker)
• CSA OSDA

Soft Skills

• Willingness and ability to work rotational shifts, including nights and weekends, as part of 24x7 SOC coverage.
• Strong written communication for incident reports, shift handovers, and periodic client-facing summaries.
• Composure under pressure, able to prioritise correctly during multi-alert or major-incident scenarios.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.