Description

You will monitor security alerts, investigate incidents, and improve detection capabilities for client environments.

This role is on-site.

Responsibilities

• Monitor SIEM alerts (Splunk, QRadar) and triage incidents across client environments.
• Lead incident response investigations from detection through containment and recovery.
• Tune detection rules to reduce false positives and surface real threats faster.
• Perform threat hunting based on MITRE ATT&CK tactics and threat intelligence.
• Document findings in clear post-incident reports for client stakeholders.

Required Skills

• 3+ years in a SOC, incident response, or blue team role.
• Hands-on experience with at least one major SIEM (Splunk, QRadar, Sentinel).
• Familiarity with EDR tools (CrowdStrike, SentinelOne, Defender for Endpoint).
• Solid understanding of networking, Windows/Linux internals, and common attack patterns.
• Strong written and verbal communication; comfortable on client calls.
• Experience contributing to SOC automation using SOAR platforms (Cortex XSOAR, Splunk Phantom).

Preferred Skills

• Security+ / CEH / GCIA certification.

Key Skills

Education

Any Graduate