Description

You will lead Tier-3 security incident investigations and manage escalations within the SOC. Your work focuses on detection, analysis, containment, and recovery across AWS, Azure, GCP, and OCI environments.

Responsibilities

• Lead Tier-3 security incident investigations and escalations within the SOC.
• Perform incident response activities including detection, analysis, containment, and recovery.
• Conduct proactive threat hunting and investigate suspicious activities using SIEM and XDR platforms.
• Develop and maintain Splunk correlation rules, dashboards, and security alerts.
• Investigate endpoint, network, email, and cloud security alerts from multiple security tools.

Required Skills

• Strong expertise in SIEM tools, specifically Splunk and Elastic Stack.
• Proficiency in cloud security monitoring across AWS, Azure, GCP, and OCI.
• Experience with Endpoint and XDR platforms such as CrowdStrike, Carbon Black, or Red Canary.
• Knowledge of security platforms including CyberArk and Zscaler.
• Experience in Network Security using Corelight, Suricata, Firewalls, and DDoS monitoring.
• Familiarity with Email Security tools like Proofpoint.
• Ability to perform root cause analysis and provide remediation recommendations.
• Bachelor's degree in a relevant field.

Key Skills

Education

Bachelor's degree