Soc Analyst - 5+ Years- Tambaram

Crescendo Global Leadership Hiring India; Chengalpattu; On-site; INR 900,000 - 1,500,000; Full time

Job summary

Crescendo Global is hiring an L1 SOC Analyst to join its Cyber Fusion Centre in Tambaram, Tamil Nadu. You will monitor security alerts, triage incidents and follow playbooks across Splunk, XSOAR and MDE to ensure rapid containment.

This 24x7 role requires precise investigation, thorough incident documentation, timely escalation to L2/L3, and close collaboration with Threat Intelligence, Threat Hunting and IT Operations teams across the regional security ecosystem.

Qualifications

• 5+ years in SOC, security monitoring or IT operations with security exposure.
• Strong networking fundamentals: IP, DNS, ports and protocols.
• Experience with ticketing tools such as ServiceNow or Jira.

Responsibilities

• Monitor and triage real-time security alerts across Splunk, XSOAR and MDE.
• Perform first-level investigation to identify true positives, false positives and benign activity.
• Log, categorize and escalate security incidents with clear timelines and evidence.
• Follow playbooks for phishing, malware, suspicious login and endpoint security alerts.
• Contain incidents at Tier-1, including endpoint isolation through MDE.
• Coordinate with L2/L3 teams and maintain shift notes and handover reports.
• Support continuous improvement of SOC runbooks and knowledge-base documentation.

Skills

SOC Analyst

Security monitoring

Incident response

SIEM

Splunk

XSOAR

MDE

Communication

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Splunk

XSOAR

Microsoft Defender for Endpoint (MDE)

Job description

We are looking for an L1 SOC Analyst to join the Cyber Fusion Centre (CFC), responsible for 24x7 security monitoring, alert triage, incident handling, and initial response across the security tool stack. This role is ideal for security professionals who are comfortable working with defined playbooks, investigating alerts, documenting incidents, and escalating security events to L2/L3 teams.

Location: Tambaram

Your Future Employer

Join a leading global financial services organization, and be part of its Cyber Fusion Centre. You will work alongside L2/L3 analysts, Threat Intelligence, Threat Hunting, and IT Operations teams across the regional security ecosystem.

Responsibilities

• Monitor and triage real-time security alerts across Splunk, XSOAR and Microsoft Defender for Endpoint (MDE).
• Perform first-level investigation to identify true positives, false positives and benign activity.
• Use Splunk queries to enrich alerts with user, asset, source/destination and timeline information.
• Log, categorize and escalat**e** security incidents through XSOAR.
• Follow established playbooks for phishing, malware, suspicious login and endpoint security alerts.
• Execute authorized Tier-1 containment actions, including endpoint isolation through MDE.
• Escalate incidents to L2/L3 teams with clear timelines, evidence and actions taken.
• Maintain accurate shift notes, incident documentation and handover reports.
• Support continuous improvement of SOC runbooks and knowledge-base documentation.
• Coordinate with IT Operations teams on security issues involving identity, network and endpoints.

Requirements

• 5+ years of experience in SOC, security monitoring or IT operations with security exposure.
• Strong understanding of networking fundamentals IP, DNS, ports and protocols.
• Knowledge of endpoint security fundamentals across Windows/macOS.
• Familiarity with SIEM concepts and basic Splunk SPL queries.
• Foundational understanding of the MITRE ATT&CK framework.
• Experience with ticketing tools such as ServiceNow, Jira or similar.
• Strong written communication and incident documentation skills.
• Willingness to work in 24x7 rotational shifts, including nights, weekends and public holidays.

Good to Have

• Exposure to Palo Alto Cortex XSOAR or another SOAR platform.
• Experience with Microsoft Defender for Endpoint (MDE) or other EDR platforms.
• Security certifications such as CompTIA Security+, CySA+ or equivalent.
• Bachelor's degree in Cybersecurity, Computer Science, IT or related field.
• Experience in banking, financial services or other regulated environments.

What is in it for you

• Opportunity to work within a global Cyber Fusion Centre.
• Hands-on exposure to SIEM, SOAR and EDR security technologies.
• Experience across incident triage, response, endpoint security and threat detection.
• Collaboration with regional L2/L3, Threat Intelligence and Threat Hunting teams.
• Build deeper expertise in enterprise cybersecurity within a regulated financial-services environment.

Disclaimer

Crescendo Global does not discriminate based on race, religion, colour, origin, gender, sexual orientation, age, marital status, veteran status or disability status.