Senior IT Cyber Defense Analyst

This is a fully remote position, open to applicants in India.

📋 Description

• Oversee SOC shift operations, prioritize alerts, manage escalations, and ensure timely handovers while adhering to service level agreements (SLAs).

• Investigate intricate incidents related to phishing, malware, ransomware, compromised accounts, endpoint threats, and suspicious network activities.

• Perform threat hunting, correlate security telemetry, and align attacker behaviors with the MITRE ATT&CK framework.

• Create, refine, and troubleshoot SIEM queries, analytics rules, and detection use cases utilizing Microsoft Sentinel and KQL.

• Employ approved AI/LLM tools for alert triage, investigation support, threat intelligence enrichment, KQL development, incident reporting, and workflow automation; independently verify AI-generated outcomes.

• Automate repetitive SOC tasks through Python, PowerShell, APIs, or SOAR capabilities.

• Mentor analysts to enhance investigation quality, minimize false positives, and ensure accurate incident documentation and audit-ready evidence.

• Collaborate with Incident Response, IT, Endpoint, Network, and Cloud teams to facilitate containment, remediation, and recovery.

• Provide effective leadership during shifts and ensure timely, high-quality incident management.

• Enhance detection coverage, improve investigation efficiency, and reduce false positives.

• Promote the practical use of AI and automation while ensuring security, accuracy, and human oversight.

• Assist in analyst development, documentation, and maintaining operational consistency.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent practical experience.

• 5+ years of experience in SOC, cyber defense, or incident response, including shift leadership, incident coordination, or mentoring analysts.

• Extensive hands-on experience with SIEM, EDR/XDR, incident investigation, and threat detection.

• Proficient in Microsoft Sentinel and KQL; experience with Microsoft Defender, CrowdStrike, or similar security platforms is essential.

• Strong understanding of networking, Windows/Linux systems, identity security, email threats, and the MITRE ATT&CK framework.

• Required practical proficiency with AI/LLM, including prompt engineering, AI-assisted investigations, validation of AI-generated queries/scripts, and awareness of hallucinations, prompt injection, and data privacy risks.

• Experience with scripting or automation using Python, PowerShell, APIs, or SOAR tools.

• Strong analytical, communication, decision-making, and leadership skills.

• Willingness to work in a 24/7 rotational shift environment.

• Relevant certifications such as Microsoft SC-200, CompTIA CySA+, GCIH, or pertinent SIEM/EDR vendor certifications.

• Experience in proactive threat hunting, detection engineering, cloud security, and improving SOC processes.

🏝️ Benefits

• Competitive salary and performance-based incentives.

• Comprehensive health, dental, and vision insurance.

• Opportunities for professional development and continuing education.

• Flexible working hours and a supportive work environment.

• Access to the latest tools and technologies in cybersecurity.