Soc Analyst

Deloitte Shared Services India; Mumbai; On-site; INR 900,000 - 1,500,000; Full time

Job summary

Deloitte Shared Services India is seeking a Security Operations Analyst to respond to security alerts and conduct in-depth investigations using SIEM, EDR/XDR, and related tools. You will validate alerts, map incidents to MITRE ATT&CK, and coordinate containment and recovery activities.

The role requires hands-on experience with QRadar/Splunk/Sentinel/Chronicle, CrowdStrike, Cortex XDR, and Microsoft Defender, along with strong knowledge of Windows/Linux security and network protections.

Qualifications

• Experience with SIEM (QRadar/Splunk/Sentinel/Chronicle) and EDR/XDR (CrowdStrike/Cortex XDR/Microsoft Defender).
• Knowledge of MITRE ATT&CK framework and Cyber Kill Chain to map attacker behaviors.
• Proficiency in incident response and root-cause analysis.
• Experience with endpoint investigations using EDR/XDR platforms.

Responsibilities

• Investigate security alerts escalated by SOC L1 using SIEM, EDR, XDR, UEBA, NDR, Email Security, and other security platforms.
• Perform in-depth analysis of security events to determine scope, impact, and root cause.
• Validate true positives and eliminate false positives through detailed log analysis.
• Classify incidents based on severity and business impact.
• Execute containment, eradication, and recovery activities as per incident response procedures.
• Escalate complex incidents to L3 or Incident Response teams when required.
• Analyze indicators of compromise (IOCs) including IPs, URLs, domains, file hashes, and email artifacts.
• Correlate events across multiple security technologies to identify sophisticated attacks.
• Identify malicious behavior using the MITRE ATT&CK framework and Cyber Kill Chain.
• Investigate phishing, malware, ransomware, insider threats, privilege misuse, and suspicious authentication activities.
• Perform endpoint investigations using EDR/XDR platforms.

Skills

MITRE ATT&CK

Cyber Kill Chain

Incident response

Endpoint investigations

Tools

QRadar

Splunk

Sentinel

Chronicle

CrowdStrike

Cortex XDR

Microsoft Defender

SOAR platforms

Job description

Role & responsibilities

• Investigate security alerts escalated by SOC L1 using SIEM, EDR, XDR, UEBA, NDR, Email Security, and other security platforms.


• Perform in-depth analysis of security events to determine scope, impact, and root cause.


• Validate true positives and eliminate false positives through detailed log analysis.


• Classify incidents based on severity and business impact.


• Execute containment, eradication, and recovery activities as per incident response procedures.


• Escalate complex incidents to L3 or Incident Response teams when required.


• Analyze indicators of compromise (IOCs) including IPs, URLs, domains, file hashes, and email artifacts.


• Correlate events across multiple security technologies to identify sophisticated attacks.


• Identify malicious behavior using the MITRE ATT&CK framework and Cyber Kill Chain.


• Investigate phishing, malware, ransomware, insider threats, privilege misuse, and suspicious authentication activities.


• Perform endpoint investigations using EDR/XDR platforms.

Required Skills

• SIEM technologies (QRadar, Splunk, Sentinel, Chronicle)


• EDR/XDR solutions (CrowdStrike, Cortex XDR, Microsoft Defender)


• SOAR platforms


• Windows and Linux security


• Active Directory


• Network Security


• Firewalls


• DNS


• Proxy

Should be available to join with 30 days.