Soc Analyst

Protiviti India; Dadri, Gurugram District, Coimbatore District; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Protiviti India is seeking a skilled cybersecurity operations professional to manage EDR platforms, monitor security events, and coordinate incident response. You will conduct threat hunting, vulnerability management, and reporting to strengthen the organization’s security posture.

The role requires 4–7 years of hands-on experience in SOC/EDR operations and familiarity with major EDR and SIEM tools. Collaboration with infrastructure and security teams is essential.

Qualifications

• 4–7 years of hands-on cybersecurity operations experience.
• Experience in SOC, MDR, EDR Operations, Incident Response, or Cyber Defense roles.
• Hands-on experience managing Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Carbon Black, or similar EDR platforms.
• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, LogRhythm, or equivalent.
• Understanding of MITRE ATT&CK, Cyber Kill Chain, and incident response methodologies.

Responsibilities

• Administer and operate EDR platforms and monitor endpoint security alerts.
• Coordinate SOC investigations and ensure SLAs for incident handling.
• Investigate cybersecurity incidents across malware, phishing, ransomware, and compromises.
• Lead threat hunting activities across endpoints, identities, cloud workloads, and network.
• Support vulnerability management by reviewing findings and tracking remediation.
• Prepare security operation reports and assist in audits and compliance.
• Contribute to SOC playbooks and continuous improvement initiatives.

Skills

EDR operations

SOC operations

Incident response

Threat hunting

Vulnerability management

Threat intelligence

Reporting & analytics

Education

Bachelor's degree in IT/CS/Cybersecurity

Tools

Microsoft Defender for Endpoint

CrowdStrike

SentinelOne

Carbon Black

Microsoft Sentinel

Splunk

QRadar

LogRhythm

Job description

Key Responsibilities

1. EDR Operations & Endpoint Security

1. Administer and operate the organization's EDR platform (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or equivalent).
2. Monitor endpoint security alerts, suspicious activities, malware detections, and behavioral indicators.
3. Investigate and validate endpoint threats, malicious processes, unauthorized access attempts, and potential compromises.
4. Conduct endpoint containment, isolation, remediation, and recovery activities.
5. Review and optimize EDR policies, detection rules, and response actions.
6. Coordinate endpoint security investigations with infrastructure and support teams.
7. Ensure coverage and health monitoring of all managed endpoints.
8. Support deployment and operational management of endpoint security controls.

2. Security Monitoring & SOC Operations

1. Monitor security alerts generated from SIEM, EDR, cloud security tools, email security platforms, and other monitoring solutions.
2. Perform triage, analysis, and prioritization of security events.
3. Validate alert severity, business impact, and escalation requirements.
4. Ensure security incidents are investigated and resolved within defined SLAs.
5. Review SOC-generated investigations and recommendations.
6. Coordinate activities with managed SOC providers for continuous monitoring and threat response.
7. Improve detection logic and monitoring coverage for emerging threats.

3. Support Incident Response & Investigation

1. Investigate cybersecurity incidents including malware, phishing, ransomware, account compromise, insider threats, and suspicious activities.
2. Coordinate incident response activities across infrastructure, network, cloud, application, and business teams.
3. Support root cause analysis and documentation of security incidents.
4. Track remediation and corrective actions until closure.
5. Escalate major incidents in accordance with Incident Response procedures.
6. Participate in security incident simulations and tabletop exercises.

4. Threat Hunting & Threat Intelligence

1. Conduct proactive threat hunting across endpoints, identities, cloud workloads, and network activities.
2. Review threat intelligence feeds, IOC alerts, and emerging threat advisories.
3. Identify indicators of compromise, attacker techniques, and unusual system behaviors.
4. Recommend new detection use cases based on threat intelligence findings.
5. Assist in improving organizational cyber defense capabilities.

5. Vulnerability Management Support

1. Review endpoint security findings and vulnerability reports.
2. Coordinate remediation of critical vulnerabilities with technology teams.
3. Validate patching and mitigation activities.
4. Track aging vulnerabilities and provide regular reporting.
5. Support risk-based prioritization of security findings.

6. Reporting & Compliance Support

1. Prepare daily, weekly, and monthly security operations reports.
2. Maintain incident records, investigation notes, forensic evidence, and audit trails.
3. Report key operational metrics including alerts, incidents, response times, and remediation status.
4. Support internal audits, client audits, ISO 27001, SOC, and regulatory compliance activities.
5. Contribute to security dashboards and executive reporting.

7. Continuous Improvement

1. Recommend improvements in monitoring, detection, response, and endpoint protection capabilities.
2. Assist in implementation of new cybersecurity technologies and security controls.
3. Develop and maintain SOC operational procedures and playbooks.
4. Participate in awareness initiatives and technical knowledge-sharing sessions.
5. Support maturity enhancement initiatives across security operations.

Qualifications & Experience

• Bachelors degree in information technology, Computer Science, Cybersecurity, or a related discipline.
• 4-7 years of hands-on cybersecurity operations experience.
• Experience working in SOC, MDR, EDR Operations, Incident Response, or Cyber Defense roles.
• Hands-on experience managing Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Carbon Black, or similar EDR platforms.
• Experience with Microsoft Sentinel, Splunk, QRadar, LogRhythm, or other SIEM platforms.
• Familiarity with Windows, Linux, Active Directory, Azure, Microsoft 365, networking, and cloud security technologies.
• Experience investigating malware, phishing, ransomware, and endpoint security incidents.
• Understanding of MITRE ATT&CK Framework, Cyber Kill Chain, and incident response methodologies.