About The Company
Tata Communications Redefines Connectivity with Innovation and IntelligenceDriving the next level of intelligence powered by Cloud, Mobility, Internet of Things, Collaboration, Security, Media services and Network services, we at Tata Communications are envisaging a New World of Communications
Technical SME (Antivirus)
Role Purpose
We are looking for a SME Technical (Antivirus) who can act as an expert for antivirus and endpoint security solutions, responsible for designing, implementing, and managing them, analysing incidents, troubleshooting complex issues, developing and maintaining security policies, and staying current with threat landscapes. This role involves deep technical knowledge of various antivirus tools and platforms, responding to threats, and providing guidance on best practices for maintaining a strong defence against malware and other threats.
Key Responsibilities / Accountabilities
- 5+ years of experience in endpoint security, preferably with Seqrite or similar platforms.
- Deep understanding of antivirus technologies, malware behaviour, and threat vectors.
- Hands-on experience with Seqrite EPP features like sandboxing, patch management, and DLP.
- Strong analytical and troubleshooting skills.
- Familiarity with Windows, Linux, and Mac endpoint environments. Lead the deployment and configuration of Seqrite EPP across enterprise endpoints.
- Provide L3-level support for antivirus-related incidents and escalations.
- Monitor and manage centralized EPP dashboards for threat detection, patching, and compliance.
- Perform root cause analysis of malware infections and security breaches.
- Collaborate with SOC/NOC teams for incident response and threat hunting. Design, implement, and manage endpoint security solutions, including antivirus software, firewalls, and intrusion detection/prevention systems.
- Monitor network and endpoint security systems to detect and respond to security incidents.
- Conduct regular security assessments and vulnerability scans to identify potential security weaknesses.
- Ensure that endpoint security systems are configured and maintained in accordance with security best practices and industry standards.
- Collaborate with network and systems administrators to ensure that endpoint security solutions are integrated into the organization’s overall security posture.
- Research and evaluate new security technologies and make recommendations for implementation.
- Develop and implement security policies and procedures for end-users, including guidelines for password management, email security, and the use of portable devices.
- Provide training and support to end-users on how to use endpoint security solutions effectively.
- Respond to security incidents and participate in incident response efforts as required.
- Stay up to date on the latest security trends and developments and maintain a high level of technical expertise in the field of endpoint security.
- Monitoring and safeguarding the log sources and security access
- Planning for disaster recovery in the event of any security breaches
- Monitor for attacks, intrusions and unusual, unauthorized or illegal activity
- Performs moderately complex log reviews and forensic analysis to identify unauthorized or unacceptable access to data or systems
- Conduct security assessments, risk analysis and root cause analysis of security incidents
- Handling incidents escalated by the L1 team in 24x7 rotational shifts
- Use advanced analytics tools to determine emerging threat patterns and vulnerabilities
- Completing all tactical security operations tasks associated with this engagement.
- Analyses all the attacks and come up with remedial attack analysis
- Conduct detailed analysis of incidents and create reports and dashboards
- As an Endpoint Detection and Response (EDR) Tools Engineer, the candidate will be part of the Cyber security team responsible for deploying, operating, and maintaining the global EDR platform. The candidate will provide support for EDR tools in the environment. The candidate must be able to communicate with the Security Operations and Incident Response teams to identify adjustments and modifications to be made to the EDR toolset. As in the most senior EDR tools engineer position, the candidate must be able to lead and by example to drive progress forward.
- Lead and oversee deployment, operation, and maintenance of the global EDR platform
- Provide support response to other security teams in respect to the EDR platform
- Identify adjustments and modifications for configuration
- Identify new opportunities for tools to incorporate into the EDR platform
- work with cross-functional teams to identify the right mix of processes and technology to implement solutions to support the needs of the internal and external customers.
- Continually work on the optimization of EDR and integrated solutions, including refinement data produced, development of automated workflows or playbooks, and integration of the EDR data with complementary security solutions, including SIEM, SOAR, etc.
- Establishing technical processes and tools focused on the incident response lifecycle. Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Event Activity.
- Work to integrate cybersecurity data using enterprise or custom tools data aggregation and analysis tools, including Splunk and similar complementary security solutions.
- Manage projects to completion both individually and in a group as well as mentoring others and orchestrating team efforts for problem solving
- Serve as an escalation point to triage and remediate security events in a SOC environment by leveraging data collected from security solutions.
- Provide support in an operations and maintenance role, including ticket work information updates, issue responses, and remediation.
- Provide content on deliverables, including written reports and technical documents, SOPs and configuration guides, and training and briefing materials
- Collaborate and consult with peers, colleagues, and managers, etc. to resolve issues and achieve goals
- General SIEM monitoring, analysis, content development, and maintenance.
- Daily security activities related to the protection of corporate and other federal assets including scanning tools and ticketing systems documenting the identification and remediation process for identified system flaws
- Provide information to system owners of flaws identified within that group responsible systems.
- Assist in risk assessment duties including reporting and oversight of remediation efforts
- Research, analysis, and response for alerts; including log retrieval and documentation.
- Conduct analysis of network traffic and host activity across a wide array of technologies and platforms.
- Assist in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, end-user interviews, and remediation efforts.
- Enterprise-level experience managing the remediation of vulnerabilities in two or more of the following areas:
- Server Operating Systems (Windows Server, Red Hat, CentOS)
- Network (Cisco, Fortinet, Palo Alto, F5, McAfee)
- Storage (NetApp, Clever Safe)
- Manage multiple projects with various priority levels and time lines from start to finish
- Develop and maintain accurate documentation for internal procedures and services
- Maintain knowledge of outstanding vulnerability management issues and ensure remediation timelines are completed by required guidelines
- Thorough understanding of how to calculate CVSS v2 and v3 adjusted scores
- Must collaborate with other departments to resolve complex issues and be detail oriented
Technical Skills
- Malware Prevention and Detection:
A deep understanding of what malware (including viruses) is, how it works, and how to prevent and detect it.
Proficiency in configuring and managing network security devices like firewalls and intrusion detection systems.
- Vulnerability Management:
The ability to identify vulnerabilities, conduct security risk assessments, and manage the patching of software and systems.
Knowledge of how to respond to and recover from security incidents and breaches.
Qualification And Certifications
- Bachelor’s degree in information security, Computer Science, or related field.
- Certifications such as CEH, Security+, or vendor-specific (Seqrite, Quick Heal).
- Experience in MSP or multi-tenant environments is a plus.
