Sr IT Cyber Defense Analyst

Jobgether; India; Remote; INR 1,800,000 - 3,200,000; Full time

Job summary

Jobgether in India is seeking a Sr IT Cyber Defense Analyst to lead a 24/7 SOC, oversee investigations, and coordinate incident handling across IT, endpoints, and cloud teams. You will leverage Microsoft Sentinel, Defender, and EDR/XDR to strengthen threat detection and response in a fast-paced, remote setting.

The role emphasizes AI-enabled investigations, threat hunting, and automation using Python, PowerShell, APIs, and SOAR, while maintaining strict compliance, shift handovers, and thorough

Qualifications

• Bachelor's degree in Cybersecurity/IT/CS or equivalent practical experience.
• 5+ years in SOC, cyber defense, or incident response with leadership or mentoring.
• Hands-on SIEM, EDR/XDR, and investigations expertise.
• Proficiency in Microsoft Sentinel and KQL with detection engineering.
• Experience with Defender, CrowdStrike, or similar platforms.
• AI/LLM proficiency including prompt engineering and validation of AI outputs.

Responsibilities

• Lead daily SOC shift operations, prioritize alerts, manage escalations, and ensure SLAs.
• Investigate complex incidents including phishing, malware, ransomware, and account compromise.
• Threat hunt by correlating telemetry and mapping adversary behavior to MITRE ATT&CK.
• Develop and optimize queries, analytics rules, and detection use cases (KQL).
• Leverage AI/LLM tools for alert triage, investigations, and automation workflows.
• Validate AI-generated queries and scripts for security and reliability.
• Automate SOC processes using Python, PowerShell, APIs, and SOAR.
• Mentor analysts, improve investigations, and promote standardized practices.
• Maintain incident records, reports, and audit-ready evidence.
• Collaborate with Incident Response, IT, Endpoint, Network, and Cloud teams.
• Balance AI adoption with human oversight and secure decision-making.

Skills

Leadership

Mentoring

Incident response

Threat detection

AI/LLM proficiency

Prompt engineering

Python

PowerShell

APIs

SOAR

Documentation

Communication

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

Microsoft Sentinel

KQL

Microsoft Defender

CrowdStrike

EDR/XDR platforms

SIEM

SOAR

Job description

Sr IT Cyber Defense Analyst based in India.

Join a cybersecurity team focused on protecting critical IT environments through advanced threat detection, incident response, and AI-enabled security operations. As a Senior IT Cyber Defense Analyst and Shift Lead, you will oversee day-to-day Security Operations Center (SOC) activities, coordinate investigations, and guide analysts in responding to evolving cyber threats. You will leverage technologies such as Microsoft Sentinel, Microsoft Defender, and endpoint detection and response (EDR) platforms to strengthen security monitoring and detection capabilities. By combining threat hunting, automation, and AI-assisted investigations, you will help improve operational efficiency while maintaining accuracy and human oversight. Working closely with incident response, infrastructure, network, endpoint, and cloud teams, you will drive timely containment, remediation, and recovery. This remote opportunity is ideal for an experienced cybersecurity professional who thrives in a fast-paced environment and is ready to lead a 24/7 security operations team.

Accountabilities

• Lead daily SOC shift operations, prioritize security alerts, manage escalations, coordinate incident handling, and ensure timely shift handovers and compliance with service-level agreements (SLAs).
• Investigate complex cybersecurity incidents involving phishing, malware, ransomware, compromised accounts, endpoint threats, and suspicious network activity.
• Conduct proactive threat hunting by correlating security telemetry, identifying attack patterns, and mapping adversary behavior to the MITRE ATT&CK framework.
• Develop, optimize, and troubleshoot SIEM queries, analytics rules, and detection use cases using Microsoft Sentinel and Kusto Query Language (KQL).
• Leverage approved AI and large language model (LLM) tools to support alert triage, investigations, threat intelligence enrichment, KQL development, incident reporting, and workflow automation.
• Independently validate AI-generated queries, scripts, and recommendations to ensure accuracy, security, reliability, and compliance with data privacy requirements.
• Automate repetitive SOC processes using Python, PowerShell, APIs, and Security Orchestration, Automation, and Response (SOAR) capabilities.
• Mentor SOC analysts, improve investigation quality, strengthen team capabilities, and promote consistent operational practices.
• Review detection performance, reduce false positives, identify coverage gaps, and continuously improve security monitoring and incident response workflows.
• Maintain accurate incident records, investigation reports, and audit-ready evidence to support compliance, operational transparency, and post-incident reviews.
• Collaborate with Incident Response, IT, Endpoint, Network, and Cloud teams to coordinate threat containment, remediation, recovery, and follow-up actions.
• Promote the responsible adoption of AI and automation while maintaining human oversight and sound cybersecurity judgment.
• Support continuous improvement initiatives to enhance detection coverage, investigation efficiency, and overall SOC performance.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related discipline, or equivalent practical experience.
• At least 5 years of professional experience in a Security Operations Center (SOC), cyber defense, or incident response, including experience in shift leadership, incident coordination, or analyst mentoring.
• Strong hands-on expertise in security information and event management (SIEM), endpoint detection and response (EDR), extended detection and response (XDR), security investigations, and threat detection.
• Proficiency in Microsoft Sentinel and Kusto Query Language (KQL), including the development and optimization of queries, analytics rules, and detection use cases.
• Experience with Microsoft Defender, CrowdStrike, or comparable enterprise security platforms.
• Strong understanding of networking, Windows and Linux environments, identity security, email-based threats, and common attack techniques.
• Practical knowledge of the MITRE ATT&CK framework and its application to threat hunting, investigation, and detection engineering.
• Mandatory AI/LLM proficiency, including prompt engineering, AI-assisted investigations, and the ability to validate AI-generated queries and scripts.
• Awareness of AI-related security and reliability risks, including hallucinations, prompt injection, and data privacy concerns.
• Scripting and automation experience using Python, PowerShell, APIs, or SOAR tools to improve operational efficiency and reduce repetitive tasks.
• Strong analytical and problem-solving skills, with the ability to investigate complex incidents, assess risk, and make sound decisions under pressure.
• Demonstrated leadership, communication, and collaboration skills, including the ability to mentor analysts and coordinate cross-functional incident response.
• Strong documentation skills and a commitment to maintaining accurate investigation records and consistent operational standards.
• Willingness and ability to work in a 24/7 rotational shift environment and support effective shift handovers and incident escalation.
• Preferred: Certifications such as Microsoft SC-200, CompTIA CySA+, GCIH, or relevant SIEM/EDR vendor certifications.
• Preferred: Experience in proactive threat hunting, detection engineering, cloud security, and SOC process improvement.

Benefits

• Fully remote work arrangement based in India, with the designated location listed as Pune or Baroda.
• Full-time employment opportunity within an established healthcare technology environment.
• Opportunity to lead security operations and contribute to the protection of critical IT systems and services.
• Hands-on exposure to AI-enabled cybersecurity tools, advanced threat detection technologies, and security automation.
• Opportunities to strengthen expertise in Microsoft Sentinel, KQL, EDR/XDR platforms, threat hunting, and incident response.
• Professional development opportunities through complex security investigations, detection engineering, and continuous improvement initiatives.
• Collaborative work with cybersecurity, infrastructure, endpoint, network, cloud, and incident response professionals.
• Opportunity to mentor team members and influence SOC processes, security standards, and operational performance.