Description

Lead Tier-3 security incident investigations and manage escalations within the SOC across AWS, Azure, GCP, and OCI environments.

This role is on-site.

Responsibilities

• Perform incident response activities including detection, analysis, containment, and recovery.
• Conduct proactive threat hunting and investigate suspicious activities using SIEM and XDR platforms.
• Develop and maintain Splunk correlation rules, dashboards, and security alerts.
• Investigate endpoint, network, email, and cloud security alerts from multiple security tools.

Required Skills

• Strong expertise in SIEM tools, specifically Splunk and Elastic Stack.
• Proficiency in cloud security monitoring across AWS, Azure, GCP, and OCI.
• Experience with Endpoint and XDR platforms such as CrowdStrike, Carbon Black, or Red Canary.
• Knowledge of security platforms including CyberArk and Zscaler.
• Experience in Network Security using Corelight, Suricata, Firewalls, and DDoS monitoring.
• Familiarity with Email Security tools like Proofpoint.
• Ability to perform root cause analysis and provide remediation recommendations.
• Bachelor's degree in a relevant field.

Preferred Skills

• 5+ years of experience in security operations or cloud security engineering.
• Experience managing Tier-3 escalations in a SOC environment.

Key Skills

Education

Bachelor's degree