- 3–5 years of hands-on experience working within a 24×7 Security Operations Center (SOC), Cyber Fusion Center, or equivalent security operations function.
- Hands-on experience in at least one or more of the following areas:
- SaaS platform security
- Cloud security, particularly AWS and/or Google Cloud Platform (GCP)
- API and container security
- Threat intelligence and threat hunting
- Vulnerability management
- SIEM or SOAR administration, engineering, or operational use
- Strong hands-on experience using SIEM platforms for security monitoring, investigation, correlation, and detection engineering. Experience with Splunk is preferred.
- Practical experience with SOAR platforms and security automation workflows.
- Hands-on experience with Endpoint Detection and Response (EDR) and related capabilities such as threat intelligence, vulnerability/exposure management, device control, or data protection.
- Hands-on experience with CSPM/CNAPP platforms such as Wiz, CrowdStrike Falcon Cloud Security, Prisma Cloud, Microsoft Defender for Cloud, Sysdig, or equivalent.
- Hands-on experience assessing, interpreting, prioritizing, and managing vulnerabilities using platforms such as CrowdStrike Exposure Management/Spotlight, Qualys, Rapid7, Wiz, or equivalent.
- Practical working experience with AWS or GCP is mandatory, including an understanding of cloud identity, logging, networking, compute, storage, and security controls.
- Basic scripting skills using Python, Bash, PowerShell, or equivalent for security operations, investigation, or automation use cases.
Incident Response & Coordination
- Demonstrated experience investigating and coordinating security incidents across technical and non-technical teams.
- Ability to act as an Incident Commander / Incident Coordinator for security incidents, driving the response from initial triage through containment, remediation, recovery, and closure.
- Ability to establish clear ownership of investigation workstreams, actions, dependencies, and follow-up activities during an incident.
- Ability to make operational decisions during an incident, prioritize investigation activities, and escalate matters requiring specialist technical, legal, privacy, compliance, or management authority.
- Ability to maintain accurate incident timelines and ensure key findings, decisions, actions, risks, and outstanding items are appropriately documented.
- Ability to provide clear and timely incident status updates to relevant stakeholders and Security leadership.
- Experience supporting or leading post-incident reviews, lessons-learned exercises, and follow-up remediation tracking.
Security Knowledge
- Good understanding of the cybersecurity incident lifecycle, including identification, triage, investigation, containment, remediation, recovery, and post-incident activities.
- Working knowledge of security frameworks and methodologies
- Understanding of cybersecurity risk concepts and the ability to assess the potential technical and business impact of identified security issues.
- Ability to monitor and assess emerging cybersecurity threats, vulnerabilities, attack techniques, and industry developments and determine their relevance to the organization.
- Strong understanding of security monitoring and investigation concepts, including the ability to correlate information across multiple security and infrastructure data sources.
- Understanding of authentication and credential-management concepts, including public/private key authentication, API keys, access tokens, service accounts, and secure credential handling.
Analytical & Operational Skills
- Ability to independently investigate and manage security events of moderate complexity, while appropriately escalating higher-risk, complex, or unfamiliar situations.
- Strong analytical and problem-solving skills, with the ability to apply logical reasoning during investigations and decision-making.
- Strong attention to detail and the ability to connect findings across logs, cloud platforms, endpoints, threat intelligence, identity systems, applications, and other relevant sources.
- Willingness to participate in and take ownership of Proofs of Concept (PoCs), security-tool evaluations, process improvements, and operational initiatives.
- Proactive approach to improving detections, automation, monitoring coverage, playbooks, documentation, and team knowledge.
- Ability to work with command-line interfaces, APIs, IDE-based tools, and modern security or cloud engineering workflows.
- Working knowledge of AI/LLM tools such as ChatGPT, Gemini, Claude, or equivalent, including their practical and secure application within Security Operations.
Communication & Collaboration
- Strong written and verbal communication skills in English, with the ability to communicate investigation findings, risks, status, and required actions clearly to both technical and non-technical stakeholders.
- Ability to communicate confidently and effectively during active security incidents and major incident calls.
- Experience working within globally distributed teams and collaborating effectively across cultures, regions, functions, and time zones.
- Collaborative and team-oriented approach, with the ability to work effectively with Security, Engineering, Product, Infrastructure, GRC, Privacy, Legal, and other business stakeholders.
- Ability to engage relevant stakeholders and escalate incidents, risks, blockers, or concerns in a timely and appropriate manner.
- Ability to provide concise and accurate shift handovers, operational updates, and incident summaries.
Shift Requirements
- Willingness and ability to work in a 24×7 monthly rotating shift schedule, including weekends.
- The position follows a five-day work week, with shift timings and weekly days off determined according to the applicable rotation schedule.
- Ability to independently own responsibilities assigned during a shift and ensure effective handover and follow-through.
- Willingness to take ownership during active security incidents occurring within the assigned shift and coordinate the response until an appropriate handover or closure.
- Entry-level or intermediate cybersecurity certifications such as CompTIA Security+, CySA+, GIAC GSEC, cloud security certifications, or equivalent industry-recognized certifications.
- Previous experience working within a SaaS, e-commerce, cloud-native, or technology company.
- Experience supporting security operations in environments involving large-scale cloud infrastructure, APIs, containers, distributed applications, or SaaS platforms.
- Previous experience acting as an Incident Coordinator, Incident Commander, or security incident lead is highly desirable.
Your success story will be
In the first 30 days you will
- Understand the roles & responsibilities of SOC team, in-scope vs out of scope tasks
- Read & understand SOPs, Policies & working procedures of the team
- Shadow peers in day to day work, overlook tickets, alerts, incidents, understand the current state of ongoing projects/enhancements etc
- Understand the team's incident response procedures, escalation paths, and shift structure. Begin handling lower-severity alerts and incidents under guidance from senior analysts
In the next 30 days you will (60 days from start)
- Start owning incidents, tasks as independent contributor with a peer shadowing you
- Participate in incident related calls, cross team/department meetings
- Handle SIEM/SOAR/EDR events. Demonstrate consistent adherence to SOPs and ticket hygiene standards. Contribute at least one update or improvement to a runbook, playbook, or knowledge base article based on hands-on experience
In the next 30 days you will(90 days from start)
- You will start documenting or tweaking existing SOPs, process document
- You will bear responsibilities of representing team in forums/meetings/discussions
- You will start managing shift alone when ne