Specialist – Cyber Security operations

AB InBev GCC India; Bengaluru; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

AB InBev GCC India is seeking a Specialist – Cyber Security Operations to join a 24x7 incident response team. You will monitor security alerts from SOC tools across on‑premise and cloud environments, investigate events, and coordinate remediation with stakeholders to minimize impact and recovery time.

You will also hunt threats using established IOCs and TTPs, document incident narratives, and work with automation and data science teams to streamline repeatable tasks.

Qualifications

• Bachelor's degree in Computer Science or Information Systems or equivalent training.
• 3 to 5 years of experience in incident response, CISRT and SOC operations.
• Strong ability to analyze security events and stitch a clear incident story.

Responsibilities

• Monitor security alerts from SOC tools across on‑premise and cloud environments.
• Investigate events to distinguish true incidents from false positives.
• Create incident narratives and communicate remediation steps to stakeholders.
• Co-relate log sources to assess impact and required actions.
• Own incidents end-to-end and ensure documentation in case records.
• Hunt threats using IOCs/TPPs and collaborate with automation teams.

Skills

Cyber incident investigations

Incident response

Threat hunting

Security event analysis

Stakeholder communication

Windows security

Education

Bachelor's degree in Computer Science or Information Systems

Tools

EDR

SIEM

Win Sys Internals

MS Defender

AWS GuardDuty

SentinelOne EDR

Job description

AB InBev GCC was incorporated in 2014 as a strategic partner for Anheuser-Busch InBev. The center leverages the power of data and analytics to drive growth for critical business functions such as operations, finance, people, and technology. The teams are transforming Operations through Tech and Analytics.

Do You Dream Big?

We Need You.

Job Description

Job Title: Specialist – Cyber Security operations

Reporting to: Sr. Manager – Cyber Security operations

Purpose of Role

Do you want to join the world largest brewer? We at AB-InBev have a fantastic opportunity for you to work as a Cyber Incident responder & join a growing team of top professionals who invest time and effort in protecting Ab-InBev from top Sophisticated Threats. We're constantly improving, advancing, and adopting new trends, new skills, and new expertise, giving our employees endless opportunities for professional development. You’ll be expected to work with in a team of incident responders operating in 24x7 shift model with deep knowledge on investigating Security alerts, and process responses for alerts generated by cyber security systems within defined timelines.

Key Tasks and Accountabilities

• Work in a team of cyber security incident responders monitoring, responding, and processing responses for the security alerts triggered from SOC tools deployed across on-premise and cloud environments like EDR, IDS/IPS, Web proxy, SIEM, phishing analysis etc., And from Cloud Security platforms like MS Defender for Cloud, AWS Guard duty, Orca Security etc.,
• Monitor threats and new attack techniques being disclosed in the wild.
• Investigate events to determine if they are true events or false positive
• Create incident storyline based on the investigations, identify and communicate required remediation steps for all security alerts/incidents.
• Co-relate different log sources to collect the evidence required to understand the impact and advise on response actions.
• Completely own the incident till all the response actions are completed and documented in case records.
• Adhere to the SLA’s and operational practices during a 24x7 shift schedule.
• Follow shift routine, regular updates to incidents, follow-up with vendors, AB InBev Zone Security contacts, and shift handover.
• Hunt down threats when needed based on TTPs, IOCs and hypothesis.
• Work closely with In-house automation and data science team to automate the repeated tasks.
• Participate in projects to improve security monitoring toolkits as well as to improve defensive controls.
• Act as an Incident commander during Critical incidents. Act quickly on identifying potential kill switch and containment. Post Containment, Prepare the incident report and share with required stakeholders
• Create Incident response SOP’s and run books as in when needed.
• Seek opportunities to drive efficiencies and collaborate with other technology teams with in and outside SOC (Eg.: NOC, Infra, automation, Cloud Ops, etc.,)
• Work closely with internal threat intel, offensive and defensive security teams to mitigate the risks identified in internal operations

Qualifications, Experience, Skills

Education:

Bachelor’s degree preferably in Computer Science or Information Systems and /or equivalent formal training or work experience.

Experience:

3 to 5 years of experience in technical roles in the areas of Incident response, CISRT and SOC Operations.

Technical/Functional Skills:

• Cyber incident investigations, corelation and ability to stitch a story - Expert
• Hands on with Comercial Cyber tools (EDR, SIEM, CDR, Web Proxy, etc.,) – Advanced
• Native Windows and cloud Security tools (Win sys internals, MS Defender, AWS Guard duty, etc.,) - Advanced
• Knowledge on Operating systems (Windows, Linux) – Advanced
• Knowledge on Operating systems (Android, iOS, MAC) – Intermediate
• Threat hunting - Intermediate

Mandatory Skills:

• Security event analysis & Cyber Incident response with Strong ability to use data points to sketch a story – Advanced
• Stakeholder Communication – Expert

Preferred (Good to have) Skills:

• Certifications - CEH, CHFI, CompTIA Security +, etc.,
• Working knowledge on SentinelOne EDR and SDL

And above all of this, an undying love for beer!

We dream big to create future with more cheers.