SOC Technical Manager - L3 (Cyber Security Expert)

Callan Hawkins; Ernakulam; On-site; INR 2,400,000 - 4,200,000; Full time

Job summary

Callan Hawkins is seeking a Senior SOC Engineer / Technical Manager (L3) to lead 24x7 operations for a global enterprise client. You will handle advanced incidents, detection engineering, automation, and client engagement, driving SOC maturity and high-severity escalations.

The role emphasizes mentoring analysts, optimizing detections, and coordinating with cross-functional teams to ensure continuous security coverage and proactive threat response.

Qualifications

• Minimum 5+ years in SOC or security operations.
• Experience leading 24x7 security operations for global clients.
• Proficient in incident handling, detection engineering, and automation.
• Strong client engagement and reporting on SOC metrics.

Responsibilities

• Act as L3 escalation point for major incidents and lead advanced investigations (memory, PCAP, registry, Kubernetes runtime).
• Perform threat hunting and detection engineering using QRadar, CrowdStrike, Darktrace, Prisma Cloud, and XSOAR.
• Develop and tune correlation rules, IOAs, and playbooks (automated triage, enrichment, containment).
• Reduce false positives through tuning, statistical analysis, and integration with ITSM workflows.
• Lead client communications and executive reviews on SOC metrics (MTTD, MTTR, FP ratio, threat trends).
• Mentor and guide L1/L2 analysts, manage shifts, and ensure 24x7 operational continuity.
• Drive the SOC roadmap playbook coverage, cloud monitoring, and detection use case enhancements.

Skills

QRadar

CrowdStrike

Darktrace

XSOAR

Prisma Cloud

Azure

Kubernetes

Windows

Linux

MacOS

Python scripting

Education

CCFA-HS

CCFR

IBM QRadar Specialist

Cortex XSOAR Specialist

GCIA

GCIH

GCFA

CKS

Azure SC-200

Tools

Python scripting

Job description

We are seeking a Senior Security Operations Centre Engineer / Technical Manager (L3) to lead 24x7 SOC operations for a global enterprise client. The role involves advanced incident handling, detection engineering, automation, and client engagement. The ideal candidate will drive SOC maturity, manage high-severity escalations, optimize detections, and mentor the SOC team.

Responsibilities

• Act as L3 escalation point for major incidents and lead advanced investigations (memory, PCAP, registry, Kubernetes runtime).
• Perform threat hunting and detection engineering using QRadar, CrowdStrike, Darktrace, Prisma Cloud, and XSOAR.
• Develop and tune correlation rules, IOAs, and playbooks (automated triage, enrichment, containment).
• Reduce false positives through tuning, statistical analysis, and integration with ITSM workflows.
• Lead client communications and executive reviews on SOC metrics (MTTD, MTTR, FP ratio, threat trends).
• Mentor and guide L1/L2 analysts, manage shifts, and ensure 24x7 operational continuity.
• Drive the SOC roadmap playbook coverage, cloud monitoring, and detection use case enhancements.

Technical Expertise Required

• SIEM: IBM QRadar (AQL, rule creation, parsing, dashboards)
• EDR: CrowdStrike Falcon (RTR, FQL, IOA/IOC tuning)
• NDR: Darktrace (model tuning, Antigena triage)
• SOAR: Cortex XSOAR (automation, integrations, Python scripting)
• Cloud Security: Prisma Cloud, Azure (alert tuning, misconfigurations, Intune compliance)
• Infra Security: Windows, Linux, MacOS, Kubernetes log analysis
• Certifications (Preferred):CCFA-HS / CCFR, IBM QRadar Specialist, Cortex XSOAR Specialist, GCIA/GCIH/GCFA, CKS, Azure SC-200.