Specialist - Information Security

Everise India BPO Services; India; Remote; INR 1,200,000 - 1,800,000; Full time

Job summary

Everise India BPO Services seeks an Information Security Specialist SOC & VAPT with 3–5 years of hands-on experience to join a demanding security operations function in India. You will triage SOC alerts, perform vulnerability testing, and coordinate remediation with cross‑functional teams.

You will enrich alerts with contextual data, gather evidence, and support audit readiness while ensuring timely closure and retesting. This role blends SOC monitoring with practical VAPT execution.

Qualifications

• 3–5 years of hands-on experience in SOC/InfoSec operations, vulnerability management or security monitoring in a BPO/regulated environment.
• Ability to run scans, validate findings, and document remediation notes with clear evidence.
• Experience with web/API security testing and manual validation using Burp Suite or OWASP ZAP.
• Knowledge of SAST/DAST tools and secure-code review processes.
• Strong written and verbal communication for incident notes, remediation follow‑ups and handovers.
• Familiarity with SIEM/MDR tooling and evidence-enrichment workflows.
• Understanding of identity/endpoint security tooling and DLP/email security workflows.
• Experience with remediation tracking in ServiceNow or equivalent.

Responsibilities

• Monitor SOC queues and investigate alerts from multiple security domains.
• Enrich alerts with context (IP, device, geo-location, IOC, etc.) and document investigations.
• Execute scheduled and ad hoc vulnerability scans; validate findings before escalation.
• Perform web/app security testing within defined scope; coordinate with owners for remediation.
• Review SAST/DAST findings and assist with secure-code reviews.
• Track remediation and retesting, maintaining evidence and closure status.
• Support containment actions and audit/ client security reviews with evidence.
• Maintain SOC/VAPT tickets with complete, evidence-backed closure details.

Skills

SOC Operations

VAPT Execution

Web/API Testing

SAST/DAST Review

Incident Response

SIEM Tools

Endpoint Security

Evidence Management

Communication Skills

GRC Awareness

Tools

Nessus

Qualys

Burp Suite

OWASP ZAP

SonarQube

Fortify

Veracode

Checkmarx

AppScan

Splunk

Microsoft Sentinel

ServiceNow

Job description

Information Security Specialist SOC & VAPT (3–5 Years)

Position Purpose:

This is a hands-on Information Security Operations role that combines SOC monitoring and investigation with Vulnerability Assessment and Penetration Testing (VAPT) execution. The individual triages and investigates SOC alerts while also running vulnerability scans, web/API security testing, and SAST/DAST review with remediation tracking through to closure. This is not a GRC analyst position; compliance or audit involvement is limited to providing accurate evidence from SOC and VAPT activities.

Principle Accountabilities (Key Result Areas)

Job Description: Core responsibilities across SOC monitoring, VAPT execution, and evidence management include the following:

• Monitor SOC queues and investigate alerts from Managed SOC/SIEM, endpoint, identity, email-security, DLP, VPN/proxy and endpoint-compliance sources.
• Enrich SOC alerts using user, device, IP, ASN, geo-location, application, timestamp, IOC, endpoint posture, related tickets and historical evidence.
• Document investigations with working notes, screenshots, containment status, closure rationale, ticket updates and shift handover notes.
• Execute scheduled and ad hoc vulnerability scans for infrastructure and applications; validate findings before escalation.
• Perform web application and API security testing under defined scope; mobile application testing is excluded unless separately assigned in the future.
• Review SAST/DAST findings, assist with secure-code review and coordinate with application/development owners for remediation evidence.
• Track vulnerability remediation and retesting in ServiceNow or approved workflow tools; maintain clean closure, retest and exception evidence.
• Support containment actions including account disablement, device freeze/quarantine/isolation, suspicious-session review, user outreach and restoration evidence.
• Prepare SOC monitoring inputs and VAPT status inputs including open vulnerabilities, overdue remediation, retest outcomes, repeat findings and escalation items.
• Provide security evidence from SOC/VAPT work when requested for audit/client/security review; do not own GRC program activities.
• Ensure SOC alerts are triaged consistently with evidence, classification, escalation notes and closure rationale (success measure).
• Validate, document and track infrastructure, web/API and SAST/DAST findings through remediation or retest (success measure).
• Escalate high-risk identity, endpoint, email, DLP, vulnerability and VPN/proxy events without delay (success measure).
• Maintain ServiceNow/security tickets that are complete, evidence-backed and aligned to SOC/VAPT operating expectations (success measure).

Attributes & Attitude

• Hands‑on investigative mindset with the discipline to perform practical triage and testing, not only ticket monitoring or scanner‑output forwarding.
• Strong escalation discipline — knows when and how to elevate to Consultant/InfoSec lead, IT Ops, GSD, Endpoint, Development, HR/Ops, TAM or Legal based on severity and impact.
• Meticulous evidence and retesting hygiene, consistently capturing screenshots, timestamps, tool outputs, reproduction steps and closure comments.
• Clear, business-formal written communication for incident notes, vulnerability findings, remediation follow‑ups and shift handovers.
• Comfortable operating across a hybrid scope — balancing SOC alert response with VAPT execution within the same role.
• Collaborative approach when coordinating with application/development owners, IT Ops and cross-functional teams on remediation evidence.
• Ownership and accountability for closure quality, without extending into GRC program ownership.
• Adaptable and detail‑oriented, able to brief a Consultant/InfoSec lead with concise facts and risk indicators.

Knowledge

Qualifications: Minimum 3-5 years of experience and working knowledge across the following areas:

• SOC Operations: 3-5 years in SOC, MDR, InfoSec operations, endpoint security, vulnerability management or security monitoring support; BPO, healthcare, PCI or client-regulated environment exposure preferred.
• Vulnerability Assessment: Ability to run scans, validate vulnerabilities, capture evidence, prepare remediation notes and support retesting; Nessus/Qualys/OpenVAS and ServiceNow remediation tracking experience preferred.
• Web/API Testing: Working knowledge of OWASP Top 10, web/API testing methodology and manual validation using Burp Suite or OWASP ZAP; experience preparing concise technical finding write-ups preferred.
• SAST/DAST/Code Review: Ability to review tool findings, understand vulnerable code patterns and coordinate with developers under senior guidance; familiarity with SonarQube, Snyk, Semgrep, Checkmarx, Veracode or Fortify preferred.
• Communication and Evidence: Clear business-formal writing for incident notes, vulnerability findings, remediation follow‑ups and shift handovers; able to brief a Consultant/InfoSec lead with concise facts and risk indicators.
• SIEM/MDR Tooling: Arctic Wolf/Aurora, Microsoft Sentinel or equivalent SIEM, Splunk/QRadar fundamentals, ServiceNow ticketing and IOC enrichment workflows.
• Identity/Endpoint Tooling: Microsoft Entra ID, Conditional Access, MFA, Defender for Endpoint, FortiEDR, Absolute, Intune/JamF, BitLocker/FileVault and endpoint evidence capture.
• Email/DLP Tooling: Abnormal AI / O365 email security, Microsoft Purview DLP, phishing/BEC/ATO investigation queues and remediation evidence.
• Network Vulnerability Tools: Nessus, Qualys, OpenVAS, Nmap, basic Metasploit validation, Wireshark and SSL/TLS testing tools.
• AD/Windows Exposure Awareness: BloodHound, PingCastle and NetExec/CrackMapExec awareness for privilege path, misconfiguration and exposure validation under supervision.
• Web/API Testing Tools: Burp Suite, OWASP ZAP, Postman, API collections and manual validation for authentication, authorization, session and input‑handling issues.
• SAST Tools: Checkmarx, Veracode, SonarQube, Fortify, Snyk, Semgrep or equivalent; ability to read code paths and identify likely vulnerable patterns.
• DAST Tools: Burp Suite, OWASP ZAP, Acunetix, Invicti/Netsparker, AppScan or equivalent; validate output before raising remediation tickets.
• Cloud Security Basics: Microsoft Defender for Cloud / Azure posture review basics, AWS exposure awareness, Prowler/ScoutSuite-style output interpretation where applicable.
• Connectivity Context: FortiSASE, FortiGate, VPN, IPQS/IP2Proxy or equivalent tools for VPN/proxy/geolocation validation.
• Desirable Certifications: eJPT / PNPT / CEH Practical, CompTIA PenTest+ / Security+ / CySA+, Burp Suite certification or web testing training, Splunk Core / SIEM fundamentals — all Good to Have.