SOC Analyst For Banagalore

Coforge; Bengaluru; In loco; INR 1.800.000 - 2.400.000; Tempo pieno

Descrizione del lavoro

Coforge in Bengaluru is seeking an experienced SOC professional to develop and fine-tune detection logic across Splunk SIEM, Splunk ES, UBA, and SOAR, collaborating with SCRAT and global teams. You will guide complex query development, reduce false positives, and ensure telemetry availability with SOC Engineering.

The role emphasizes threat intelligence translation, KPI development, dashboards, and mentoring junior Splunk administrators, with 6–8 years in SOC or security engineering.

Competenze

• 6–8 years of SOC, threat detection or security engineering experience.
• Advanced in analyzing security events on Linux and Windows, with log enrichment.
• Strong SIEM query skills (Splunk SPL, KQL, CrowdStrike Query Language) for threat detection and hunting.
• Proficient in Python and PowerShell; able to automate detection logic and support orchestration.
• Experience with MITRE ATT&CK mapping and threat intelligence translation.
• Splunk ES/UBA/SOAR familiarity; Splunk certifications are a plus.

Mansioni

• Develop and tune detection logic and correlation rules across Splunk SIEM and detection platforms.
• Collaborate with SCRAT to enhance detection and response automation.
• Support complex query development and troubleshooting in SOC.
• Reduce false positives and improve alert fidelity through iterative tuning.
• Ensure telemetry and event sources are available with SOC Engineering.
• Translate threat intel into actionable detection content and KPIs.
• Mentor junior Splunk admins on data ingestion and indexing.
• Participate in red/blue/purple team exercises to validate detection.
• Contribute to dashboards, threat hunting, and SOC performance reporting.

Conoscenze

SOC

Threat detection

Splunk SPL

KQL

CrowdStrike QL

Python

PowerShell

MITRE ATT&CK

Splunk ES

UBA

SOAR

Torq

Team mentoring

Threat hunting

Strumenti

Splunk ES

UBA

SOAR

Torq

Descrizione del lavoro

Key Responsibilities:

• Operate under the SOC function, reporting to the SOC Manager, with responsibility for developing and fine-tuning detection logic and correlation rules in Splunk SIEM and other detection platforms (e.g., Splunk ES, UBA, SOAR)
• Collaborate actively with the Global Security Content and Response Automation Team (SCRAT) to enhance detection logic and response automation
• Participate in daily SOC stand-up calls and provide support for complex query development and troubleshooting
• Oversee the quality and effectiveness of detection logic, continuously reducing false positives and improving alert fidelity through iterative tuning and feedback
• Work closely with SOC Engineering to ensure necessary telemetry and event sources are available for effective threat detection
• Stay up to date with emerging threats and attacker techniques, translating threat intelligence into actionable detection content
• Maintain comprehensive documentation for detection logic, including rule rationale, expected behaviour, and tuning history.
• Perform threat coverage gap analysis and mapping using frameworks such as MITRE ATT&CK
• Support threat hunting initiatives by developing custom queries, dashboards, and analytics
• Mentor junior Splunk administrators on data ingestion, parsing, indexing, and troubleshooting
• Participate in red/blue/purple team exercises to validate and improve detection effectiveness.
• Assist in the development of detection-related KPIs and metrics for SOC performance reporting.

Skills and Experience:

• 6-8 years of experience in SOC, threat detection, or security engineering roles
• Advanced proficiency in analysing security events across both Linux and Windows environments, including log source normalization and enrichment
• Strong command of SIEM query languages (e.g., Splunk SPL, KQL, CrowdStrike Query Language), with the ability to write complex queries for threat detection, hunting, and anomaly identification
• Proficiency in scripting languages such as Python and PowerShell, with experience automating detection logic and integrating with orchestration workflows
• Demonstrated expertise in building and maintaining detection content, including correlation searches and risk-based alerting
• Deep understanding of the MITRE ATT&CK framework and the ability to accurately map detection logic to specific TTPs
• Hands-on experience with the Splunk ecosystem, including Enterprise Security (ES), User Behaviour Analytics (UBA), SOAR, and apps like Torq
• Strong foundational knowledge of cybersecurity principles, threat landscapes, and incident response methodologies
• Excellent communication and collaboration skills, with the ability to work effectively across SOC, IR, and global engineering teams
• Strong analytical and problem-solving abilities
• Splunk certifications (e.g., Admin, Power User, Developer) are a plus