SOC Analyst

R360 Group; Bengaluru; On-site; INR 900,000 - 1,500,000; Full time

Job summary

R360 Group is seeking a SOC Analyst to monitor endpoint and cloud threat activity, triage alerts, and map detections to MITRE ATT&CK. You will tune rules, escalate incidents, and support regulatory reporting for BFSI clients.

The role involves containment and recovery actions, collaboration with SIEM, and mentoring junior staff. A background in regulated environments and EDR/XDR tooling is required.

Qualifications

• Bachelor's degree in CS/IT or equivalent practical experience.
• 2–3 years hands-on SOC/blue-team experience in regulated environment.
• Experience with at least one EDR/XDR platform; CrowdStrike Falcon and/or SentinelOne preferred.
• Solid knowledge of MITRE ATT&CK framework and cyber kill chain.
• Familiarity with PCI DSS v4.0.1, RBI framework, and DPDP Act basics.
• Comfort with Windows and Linux internals; TCP/IP and HTTP/S.

Responsibilities

• Monitor CrowdStrike Falcon, SentinelOne, PIM, PAM, and DAM Singularity consoles for detections across production and UAT estates.
• Maintain client-segmented visibility and SLA adherence for bank environments per InfoSec SLA.
• Perform L1/L2 alert triage and map detections to MITRE ATT&CK tactics/techniques.
• Tune detection rules to reduce false positives without eroding coverage.
• Escalate incidents per SOC matrix with clear severity and business impact.
• Execute containment, eradication and recovery actions using EDR tooling.
• Preserve chain-of-custody and support regulatory reporting (RBI/CERT-In).
• Threat hunt across endpoint telemetry; correlate with SIEM and cloud logs.
• Support PCI DSS ISO 27001 audits with SOC tooling evidence.
• Mentor SOC interns and contribute to playbooks.

Skills

EDR/XDR platforms

MITRE ATT&CK

SIEM correlation

Blue-team experience

Python/PowerShell

Incident response

Communication skills

24x7 shifts

CCFA/CCFR

CEH

Education

Bachelor's degree in CS/IT

Tools

CrowdStrike Falcon

SentinelOne Singularity

SIEM (Splunk/QRadar/Microsoft Sentinel/ELK)

Python

PowerShell

Job description

Key Responsibilities

• Monitor CrowdStrike Falcon, SentinelOne , PIM,PAM, and DAM Singularity consoles for endpoint, cloud workload, and identity-based threat detections across production and UAT estates.
• Maintain client-segmented visibility and SLA adherence for HDFC, ICICI, and Kotak-linked environments in line with each bank's InfoSec SLA and contractual security addenda.
• Perform L1/L2 alert triage and investigation, mapping detections to MITRE ATT&CK tactics/techniques.
• Tune detection rules (custom IOAs in CrowdStrike, Deep Visibility / STAR rules in SentinelOne) to reduce false positives without eroding coverage.
• Escalate confirmed incidents per the SOC escalation matrix, with clear severity classification and business-impact framing.
• Execute containment, eradication, and recovery actions using EDR host-isolation and remediation capability.
• Preserve chain-of-custody and forensic integrity for evidence supporting internal investigations and, where required, regulator/bank-facing reporting. Support incident timelines aligned to RBI's cyber-incident reporting mandate and CERT-In reporting obligations.

4. Threat Hunting & Detection Engineering

• Run hypothesis-driven threat hunts across endpoint telemetry, prioritizing BFSI-targeted TTPs (banking trojans, ATM/POS malware families, phishing-to-RAT chains, credential-harvesting campaigns).
• Correlate EDR telemetry with SIEM, AWS WAF, CloudTrail, and application logs to reconstruct crossenvironment attack chains.

5. Compliance, Audit & Change Support

• Provide InfoSec sign-off inputs for change requests (PCCB) impacting SOC-monitored assets, where applicable.
• Support PCI DSS QSA assessments, ISO 27001 audits, and bank-specific annual vendor security reviews with SOC tooling evidence (alert logs, detection coverage reports, response-time metrics).
• Maintain shift handover notes, SOC playbooks, and runbooks; contribute to continuous improvement of detection use cases.
• Mentor SOC interns on triage methodology, tool usage, and escalation discipline.

Required Qualifications

• Bachelor's degree in computer science, IT, or a related field (or equivalent practical experience).
• 2–3 years of hands-on SOC / blue-team experience, ideally within BFSI, fintech, or another regulated environment.
• Working expertise with at least one EDR/XDR/ platform, incident responder; CrowdStrike Falcon and/or SentinelOne Singularity strongly preferred.
• Solid grounding in the MITRE ATT&CK framework, cyber kill chain analysis, and common BFSI threat-actor TTPs.
• Familiarity with SIEM platforms (Splunk / QRadar / Microsoft Sentinel / ELK) for cross-source log correlation.
• Working knowledge of PCI DSS v4.0.1 (particularly Requirements 10, 11, and 12), the RBI Cyber Security Framework, and DPDP Act 2023 fundamentals.
• Comfort with Windows and Linux internals, core network protocols (TCP/IP, DNS, HTTP/S), and common attack vectors.
• Scripting/automation ability (Python or PowerShell) for detection engineering or SOAR playbook development is a strong plus.
• Familiarity with building internal SOC tools and Agentic automation.

Preferred Certifications

• CrowdStrike Certified Falcon Administrator (CCFA) or Responder (CCFR)
• CEH (Certified Ethical Hacker)

Soft Skills

• Willingness and ability to work rotational shifts, including nights and weekends, as part of 24x7 SOC coverage.
• Strong written communication for incident reports, shift handovers, and periodic client-facing summaries.
• Composure under pressure, able to prioritise correctly during multi-alert or major-incident scenarios.