SOC Lead

Kyndryl; Dadri; Presencial; INR 1.500.000 - 2.800.000; Tempo integral

Resumo da vaga

Kyndryl Inc. in Uttar Pradesh seeks a seasoned cybersecurity engineer to protect critical systems and manage 24x7 SOC operations. You will oversee the deployment and maintenance of security solutions, coordinate with the Architecture team, and drive incident response during your shift.

The role emphasizes hands-on expertise with SIEM, EDR, DLP, and incident management processes, including RCA, handovers, and mentoring L1/L2 analysts to improve detection and resilience.

Qualificações

• 4 to 5 years of security operations experience.
• Hands-on with SIEM, EDR, and DLP tools.
• Strong incident management and escalation capabilities.
• Customer-focused with collaborative mindset.

Responsabilidades

• Investigate and resolve escalated security incidents from L1 and L2 analysts.
• Perform deep-dive forensic analysis, triage, and RCA for critical incidents.
• Monitor the health and performance of SIEM infrastructure and security sensors.
• Lead shift handovers and maintain incident logs and metrics.
• Escalate unresolved issues to SOC Manager as needed.
• Coordinate with OEM vendors for platform issues or advanced threat resolution.
• Coordinate with DLP, EDR, and Email Security SMEs for multi-vector incident resolution.
• Mentor L1/L2 analysts and contribute to skill development plans.

Conhecimentos

SOC Lead

Incident management

Security incident response

Forensic analysis

RCA

SIEM monitoring

SLA adherence

Team mentoring

Playbook development

Vendor coordination

Ferramentas

MS Sentinel

Logic Apps

ServiceNow

Descrição da vaga

Shift and Schedule: 5 Days Office (Rotational)

Summary:

A cybersecurity engineer is responsible for protecting computer systems and networks from cyber threats, such as hacking, viruses, and other malicious attacks. Their job involves overseeing the implementation, deployment and maintenance of security solutions to ensure the confidentiality, integrity, and availability of data. Interacts with the Cybersecurity Architecture team to provide feedback on design and any areas in need of improvement.

Job Qualifications: You’re good at what you do and possess the required experience to prove it. However, equally as important – you have a growth mindset; keen to drive your own personal and professional development. You are customer-focused – someone who prioritizes customer success in their work. And finally, you’re open and borderless – naturally inclusive in how you work with others.

Required Skills and Experience:

• Need 4 to 5 years of experience.
• The SOC Lead cum Shift Incident Manager plays a dual role: as a senior technical expert, handling complex security incidents and as the shift lead responsible for managing SOC operations during their assigned shift. This role is critical in ensuring 24x7 incident response, operational continuity, and escalation governance.
• Investigate and resolve escalated security incidents from L1 and L2 analysts.
• Perform deep-dive forensic analysis, triage, and root cause analysis (RCA) for critical and high-severity incidents
• The candidate should have hands-on experience in monitoring, analyzing, and responding to security alerts from Microsoft Sentinel, DLP solutions, and CrowdStrike EDR.
• Monitor the health and performance of SIEM infrastructure and security sensors.
• Tune and manage SIEM rules, correlation logic, and detection use cases.
• Coordinate with OEM vendors for platform issues or advanced threat resolution
• Act as the Incident Manager for the shift, overseeing all incident response activities and ensuring SLA adherence
• Lead shift handover meetings and maintain continuity across shifts.
• Assign tasks to L1/L2 analysts and ensure proper documentation in ITSM tools (e.g., ServiceNow)
• Escalate unresolved or critical issues to the SOC Manager or CDC Head as neededMaintain shift logs, incident metrics, and RCA documentation.
• Conduct training sessions and contribute to skill development plans
• Review and refine incident response procedures and playbooks.
• Collaborate with SIEM Engineers, SOAR Developers, and Content Writers to enhance detection and automation workflows
• Coordinate with DLP, EDR, and Email Security SMEs for multi-vector incident resolution.

Preferred Skills and Experience:

• Tool used-MS Sentinel and Logicapps
• Participate in governance forums and lessons learned reviews
• Provide feedback on detection quality, false positives, and tuning opportunities.
• Guide L1 and L2 analysts during investigations and response activities.