Senior IT Cyber Defense Analyst

This is a fully remote position, open to applicants in India.

📋 Description

• Oversee SOC shift operations, prioritize alerts, manage escalations, and guarantee timely handovers while adhering to SLAs.

• Investigate intricate incidents related to phishing, malware, ransomware, compromised accounts, endpoint threats, and suspicious network activities.

• Conduct threat hunting, correlate security telemetry, and align attacker behavior with the MITRE ATT&CK framework.

• Create, refine, and troubleshoot SIEM queries, analytics rules, and detection use cases utilizing Microsoft Sentinel and KQL.

• Leverage approved AI/LLM tools for alert triage, investigation support, threat intelligence enhancement, KQL development, incident reporting, and workflow automation; independently assess AI-generated results.

• Automate repetitive SOC tasks through Python, PowerShell, APIs, or SOAR functionalities.

• Mentor analysts, enhance investigation quality, minimize false positives, and maintain precise incident documentation along with audit-ready evidence.

• Collaborate with Incident Response, IT, Endpoint, Network, and Cloud teams to assist in containment, remediation, and recovery efforts.

• Provide effective shift leadership and ensure timely and high-quality incident management.

• Enhance detection coverage, improve investigation efficiency, and reduce false positives.

• Promote the practical application of AI and automation while ensuring security, accuracy, and human oversight.

• Support analyst growth, documentation, and operational consistency.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent hands-on experience.

• Over 5 years of experience in SOC, cyber defense, or incident response, including shift leadership, incident coordination, or mentoring analysts.

• Extensive hands-on experience with SIEM, EDR/XDR, incident investigation, and threat detection.

• Proficient in Microsoft Sentinel and KQL; experience with Microsoft Defender, CrowdStrike, or similar security platforms.

• Strong grasp of networking, Windows/Linux, identity security, email threats, and MITRE ATT&CK.

• Essential practical proficiency in AI/LLM, including prompt engineering, AI-assisted investigations, validation of AI-generated queries/scripts, and awareness of hallucinations, prompt injection, and data privacy risks.

• Experience in scripting or automation using Python, PowerShell, APIs, or SOAR tools.

• Strong analytical, communication, decision-making, and team leadership abilities.

• Willingness to work in a 24/7 rotational shift environment.

• Certifications such as Microsoft SC-200, CompTIA CySA+, GCIH, or relevant SIEM/EDR vendor certifications.

• Experience in proactive threat hunting, detection engineering, cloud security, and SOC process enhancement.

🏝️ Benefits

• 24/7 rotational shifts.

• AI-enabled security operations environment.

• Mentoring and analyst development opportunities.