Soc Analyst

BUSINESSNEXT; Dadri; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

BUSINESSNEXT is seeking an experienced Security Operations professional to design, implement, and optimize detections across SIEM, EDR/XDR, and cloud environments. You will translate threat intelligence into actionable detections, lead complex investigations, and drive automation to improve SOC efficiency.

The role requires strong knowledge of MITRE ATT&CK, SIEM architectures, and hands-on experience with Defender/CrowdStrike/SentinelOne/Cortex XDR, plus cloud security across AWS, Azure, and

Qualifications

• 5+ years in Security Operations, SOC engineering, detection engineering, or incident response.
• Hands-on with enterprise SIEM platforms and log management practices.
• Strong knowledge of ATT&CK, kill chain, and threat detection methods.

Responsibilities

• Design and optimize detection rules across SIEM, EDR/XDR, cloud, identity, email, and network security.
• Assess telemetry coverage and identify visibility gaps with recommended improvements.
• Translate threat intelligence and incident learnings into detections and use cases.
• Improve detection fidelity by reducing false positives and duplicates.
• Lead technical investigations for high-severity incidents and containment guidance.
• Develop automation and orchestration workflows using SOAR platforms.
• Support cloud security monitoring across AWS, Azure, and GCP.
• Evaluate security visibility for containers and Kubernetes environments.
• Create technical docs, runbooks, and operational procedures.

Skills

Security Operations

SOC Engineering

Detection Engineering

Incident Response

AI tooling

Tools

Microsoft Sentinel

Splunk Enterprise Security

Elastic SIEM

IBM QRadar

CrowdStrike Falcon

SentinelOne

Cortex XDR

AWS

Azure

GCP

Windows

Linux

Entra ID

Job description

What would you do?

• Design, develop, and optimize high-fidelity detection rules across SIEM, EDR/XDR, cloud, identity, email, and network security platforms.
• Assess telemetry coverage across endpoint, network, identity, cloud, and SaaS environments, identifying visibility gaps and recommending improvements.
• Translate threat intelligence, threat hunting findings, and incident learnings into actionable detections and use cases.
• Continuously improve detection fidelity by reducing false positives, eliminating duplicate alerts, and expanding detection coverage.
• Lead technical investigations for complex and high-severity security incidents, providing guidance on containment, eradication, and recovery.
• Develop and maintain automation and orchestration workflows using SOAR platforms to improve SOC efficiency.
• Support cloud security monitoring across AWS, Azure, and GCP environments.
• Evaluate and improve security visibility for containers, Kubernetes, and modern application environments.
• Create and maintain technical documentation, detection logic, runbooks, and operational procedures.
• Stay current with emerging cyber threats, attack techniques, and advancements in security technologies.

AI Enabled Qualifications:

• Demonstrated ability to leverage AI-powered tools for IT operations, incident analysis, workflow automation, and operational reporting.
• Proactive in adopting emerging AI technologies to enhance system reliability, team productivity, and data-driven decision-making.

Qualifications & Requirements

• 5+ years of experience in Security Operations, SOC Engineering, Detection Engineering, or Incident Response.
• Hands-on experience administering enterprise SIEM platforms such as Microsoft Sentinel, Splunk Enterprise Security, Elastic, IBM QRadar.
• Strong understanding of SIEM architecture, log management, parsing, normalization, correlation rules, data models, and performance optimization.
• Strong knowledge of MITRE ATT&CK, cyber kill chain, threat detection methodologies, and attacker tactics and techniques.
• Hands-on experience with EDR/XDR technologies such as Microsoft Defender, CrowdStrike Falcon, SentinelOne, or Cortex XDR.
• Working knowledge of cloud security services across AWS, Azure, or Google Cloud Platform.
• Strong understanding of Windows, Linux, Active Directory, Entra ID, networking protocols, and authentication technologies.
• Experience with scripting or automation using Python, PowerShell, or Bash.
• Experience working with SOAR platforms and security automation.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent communication skills with the ability to collaborate across technical and business teams.