408 Qradar Jobs - Page 7

Make an impact with NTT DATA Join a company that is pushing the boundaries of what is possible. We are renowned for our technical excellence and leading innovations, and for making a difference to our clients and society. Our workplace embraces diversity and inclusion – it’s a place where you can grow, belong and thrive. Your day at NTT DATA The Security Managed Services Engineer (L2) is a developing engineering role, responsible for providing a managed service to clients to ensure that their Security Infrastructures and systems remain operational. Through the proactive monitoring, identifying, investigating, and resolving of technical incidents and problems, this role is able to restore service to clients. The primary objective of this role is to proactively review client requests or tickets and apply technical/process knowledge to resolve them without breaching service level agreement (SLA) and focuses on second-line support for incidents and requests with a medium level of complexity. The Security Managed Services Engineer (L2) may also contribute to / support on project work as and when required. What You'll Be Doing Academic Qualifications and Certifications: BE/BTech in Electronics/EC/EE/CS/IT Engineering or MCA At least one security certification such as CCNA Security, CCSA, CEH, CompTIA, GCIH/GCIA Required Experience: At least one SIEM solution certifications with one or more SIEM/ Security solutions (i.e., RSA NetWitness, Splunk ES, Elastic ELK, HP ArcSight, IBM QRadar Log Rhythm). Minimum overall 5 years of experience in handling security related products & services in a reputed organization out of which 3 years’ experience should be in SIEM solution. Person should have adequate knowledge of security devices like firewalls, IPS, Web Application Firewall, DDOS, EDR, Incident response, SOAR and other security devices Administration of SIEM environment (e.g.: deployment of solution, user management, managing the licenses, upgrades and patch deployment, addition or deletion of log sources, configuration management, change management, report management, manage backup and recovery, etc.) Construction of SIEM content required to produce Content Outputs (e.g., filters, active lists, correlation rules, reports, report templates, queries, trends, variables) Integration of customized threat intelligence content feeds provided by the Threat Intelligence & Analytics service Identifies possible sensor improvements to prevent incidents Collects/updates threat intelligence feeds from various sources Creates situational awareness briefings Co-ordinates with the different departments for incident analysis, containment and remediation Liaise with Security monitoring team to discover repeatable process that lead to new content development Provides engineering analysis and architectural design of technical solutions Knowledge of networking protocols and technologies and network security Sound analytical and troubleshooting skills Key Responsibilities: Monitors client infrastructure and solutions. Identifies problems and errors prior to or when they occur. Routinely identifies common incidents and opportunities for avoidance as well as general opportunities for incident reduction. Investigates first line incidents assigned and identifies the root cause of incidents and problems. Provides telephonic or chat support to clients when required. Schedules maintenance activity windows for patching and configuration changes. Follows the required handover procedures for shift changes to ensure service continuity. Reports and escalates incidents where necessary. Ensures the efficient and comprehensive resolutions of incidents and requests. Updates existing knowledge articles or create new ones. Identifies opportunities for work optimization including opportunities for automation of work, request fulfilment, incident resolution, and other general process improvement opportunities. May also contribute to / support on project work as and when required. May work on implementing and delivering Disaster Recovery functions and tests. Performs any other related task as required. Workplace type: On-site Working About NTT DATA NTT DATA is a $30+ billion trusted global innovator of business and technology services. We serve 75% of the Fortune Global 100 and are committed to helping clients innovate, optimize and transform for long-term success. We invest over $3.6 billion each year in R&D to help organizations and society move confidently and sustainably into the digital future. As a Global Top Employer, we have diverse experts in more than 50 countries and a robust partner ecosystem of established and start-up companies. Our services include business and technology consulting, data and artificial intelligence, industry solutions, as well as the development, implementation and management of applications, infrastructure, and connectivity. We are also one of the leading providers of digital and AI infrastructure in the world. NTT DATA is part of NTT Group and headquartered in Tokyo. Equal Opportunity Employer NTT DATA is proud to be an Equal Opportunity Employer with a global culture that embraces diversity. We are committed to providing an environment free of unfair discrimination and harassment. We do not discriminate based on age, race, colour, gender, sexual orientation, religion, nationality, disability, pregnancy, marital status, veteran status, or any other protected category. Join our growing global team and accelerate your career with us. Apply today. Show more Show less

Must have skills : Azure Sentinel L2/L3 SOC Analyst Preferred : HYD Exp : Minimum 6 yrs in security domain, and atleast 3 yrs as L2/L3 JD : .Develop and maintain playbooks runbooks and incident response procedures .Collaborate with threat intelligence teams to enrich alerts and improve detection capabilities .Conduct post incident reviews and root cause analysis .Mentor and train L1 and L2 SOC analysts .Recommend and implement improvements to SOC tools processes and detection rules .Stay current with emerging threats vulnerabilities and security technologies .The expectations from the graders would be .To evaluate the tasks that are being fed into the agent for their real world applicability .To evaluate the agent output to come up with a ground truth and rate the agent output in a .Predefined rubric based on the inputs provided by us .To have very deep SOC analyst experience and insights This also includes any other skills needed .T.o evaluate the agent output The ability to scale to around min 2030 evaluations per day per grader based on the complexity of the task. Core Technical Skills:- .SIEM Tools eg Splunk QRadar Microsoft Sentinel .Endpoint Detection and Response EDR eg CrowdStrike SentinelOne .Firewall and IDSIPS eg Palo Alto Snort Suricata .Log Analysis and Packet Capture Analysis eg Wireshark .Threat Intelligence Platforms eg MISP Recorded Future .Incident Response and Forensics .Scripting Automation Python PowerShell Bash .Operating Systems Windows Linux macOS .Networking Fundamentals TCPIP DNS HTTP VPNs Kindly share your CV at Ranjana.singh1@ltimindtree.com Regards Ranjana Singh Show more Show less

Job requisition ID :: 82920 Date: Jun 4, 2025 Location: Delhi Designation: Consultant Entity: SOC Ops + QRadar

We are seeking a talented and highly motivated Microsoft Sentinel SIEM Engineer to join our Dedicated Defense group. As a key member of our team, you will be responsible for deploying and maintaining Microsoft Security technologies to enhance threat detection, response, and overall security posture. This is an exciting opportunity for an individual with expertise in major SIEM technologies, aiming to help safeguard critical systems and data from evolving cyber threats. Responsibilities: Architect, deploy, and maintain Microsoft Sentinel for SIEM use cases including log ingestion, data normalization, and incident correlation. Manage and optimize Microsoft Defender for Endpoint, Identity, Cloud, Office 365, and other Defender tools to maximize protection and visibility. Develop custom queries,detection rules, workbooks, and automation playbooks to improve threat detection and response efficiency. Lead the design and implementation of security monitoring, including data connectors, analytics rules, and incident automation. Collaborate with threat analysts and incident response teams to triage, investigate, and respond to security alerts and incidents. Provide technical guidance in security best practices, incident response procedures, and threat hunting using Microsoft security tools. Continuously assess the security landscape and recommend improvements to policies, tools, and configurations. In addition to strong technical acumen, the ideal candidate will bring excellent communication and client-facing skills to collaborate directly with customers, understand their security needs, and deliver tailored solutions that align with their risk posture and compliance requirements. Outcomes: Integration & Optimization: Integrate and optimize Microsoft Sentinel to improve visibility and automate threat detection workflows Threat Detection: Utilize Microsoft Sentinel AI-powered analytics to dashboard reports and automate critical reporting functions Automation & Playbook Development: Develop automated detection and response playbooks based on Microsoft data feeds, streamlining incident management and reducing time to resolution. Collaboration & Knowledge Sharing: Work closely with other security and IT teams to share threat intelligence, optimize SIEM use, and contribute to security strategy development. Reporting & Documentation: Develop and maintain dashboards, reports, and documentation related to Microsoft Sentinel deployment, performance, and incident metrics. Continuous Improvement: Continuously evaluate Microsoft Sentinel capabilities and other relevant security tools to recommend improvements and refine detection capabilities. Required Qualifications: 5 years of SIEM experience in Splunk, Qradar, Microsoft, and comparable SIEMS Hands-on experience with other SIEM platforms (Splunk, IBM QRadar, Microsoft Sentinel, etc.) and integrating them with endpoint security tools. Strong understanding of cybersecurity principles, threat detection, and SIEM management. Experience working with Sentinel One Core EDR technology Proficiency in scripting and automation (Python, PowerShell, etc.). Experience with cloud security (AWS, Azure, GCP) and cloud-native SIEM solutions is a plus. Bachelor’s degree in computer science, Information Security, or a related field (or equivalent experience). Preferred Qualifications: 5 years of experience in cybersecurity in a SOC or security engineering capacity. Proven hands-on expertise with Microsoft Sentinel and Microsoft Defender suite. Deep knowledge of Kusto Query Language (KQL) and building custom analytics rules and workbooks in Sentinel. Strong experience in customer-facing roles. Experience with incident response, threat detection, and threat hunting techniques. Strong understanding of cloud security, especially in Azure environments. Familiarity with MITRE ATT&CK, NIST, and other security frameworks. Experience integrating Sentinel with third-party solutions (e.g., threat intel feeds, ticketing systems).

Wells Fargo is seeking a Senior Information Security Engineer. In this role, you will: Lead or participate in computer security incident response activities for moderately complex events Conduct technical investigation of security related incidents and post incident digital forensics to identify causes and recommend future mitigation strategies Provide security consulting on medium projects for internal clients to ensure conformity with corporate information, security policy, and standards Design, document, test, maintain, and provide issue resolution recommendations for moderately complex security solutions related to networking, cryptography, cloud, authentication and directory services, email, internet, applications, and endpoint security Review and correlate security logs Utilize subject matter knowledge in industry leading security solutions and best practices to implement one or more components of information security such as availability, integrity, confidentiality, risk management, threat identification, modeling, monitoring, incident response, access management, and business continuity Identify security vulnerabilities and issues, perform risk assessments, and evaluate remediation alternatives Collaborate and consult with peers, colleagues and managers to resolve issues and achieve goals Required Qualifications: 4+ years of Information Security Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education Desired Qualifications: 4+ years of demonstrated information security applications and systems experience 4+ years of demonstrated experience leveraging security technologies such as SIEM for security incident analysis 2+ years of demonstrated experience with at least one scripting language (preferably JavaScript and its frameworks / Python) working on automation and engineering projects Proficiency in detection engineering developing and maintaining effective detection rules and correlation logic. Correlation searches, rules, alerts. Behavioral detections (e.g., brute-force, privilege escalation). Anomaly detections (e.g., unusual logon patterns, entropy-based detections). Hands-on experience with parsing configurations (props, transforms, regex, normalization techniques). Expertise in log source onboarding , source categorization, and enrichment. Strong understanding of security event types (firewall, endpoint, identity, cloud, SaaS logs). Familiarity with common attack vectors (credential abuse, privilege escalation, lateral movement). Knowledge of threat detection frameworks like MITRE ATT&CK, NIST, CIS . Ability to work with threat intelligence feeds to build contextual detections. Experience with log analysis , anomaly detection , and statistical detection methods. Proficient in developing content for SIEMs such as Splunk, Sentinel, QRadar, ArcSight, Elastic, etc. Optimize search performance and false positive tuning of existing detection rules. Maintain deployment workflows for apps, configurations, and detection packages across the SIEM infrastructure. Work with security analytics teams to develop data models or normalized schemas (CIM or equivalent). Job Expectations: Knowledge and understanding of banking or financial services industry Should possess understanding of security and threat landscape relevant to cloud technologies Excellent verbal, written, and interpersonal communication skills Strong ability to identify anomalous behavior on endpoint devices and/or network communications Advanced problem solving skills, ability to develop effective long-term solutions to complex problems Relevant certifications such as Splunk Certified Admin, Splunk Enterprise Security Certified Admin.

Understanding of network defence principles, common attack vectors, and attacker techniques. Technical baseline skills and the ability to acquire in-depth knowledge of network and host security technologies Basic Linux/Windows OS knowledge, firewall rules and policy fundamentals. Excellent analytical and problem-solving skills. Strong work ethic and commitment to accomplish assigned tasks with a sense of urgency. Windows, Linux, Network Security, Phishing, Splunk, Malware

Title: Security Analyst (SOC & EDR) Location: Gurgaon, India Type: Hybrid (work from office) Job Description Who We Are: Fareportal is a travel technology company powering a next-generation travel concierge service. Utilizing its innovative technology and company owned and operated global contact centers, Fareportal has built strong industry partnerships providing customers access to over 600 airlines, a million lodgings, and hundreds of car rental companies around the globe. With a portfolio of consumer travel brands including CheapOair and OneTravel, Fareportal enables consumers to book-online, on mobile apps for iOS and Android, by phone, or live chat. Fareportal provides its airline partners with access to a broad customer base that books high-yielding international travel and add-on ancillaries. Fareportal is one of the leading sellers of airline tickets in the United States. We are a progressive company that leverages technology and expertise to deliver optimal solutions for our suppliers, customers, and partners. FAREPORTAL HIGHLIGHTS: Fareportal is the number 1 privately held online travel company in flight volume. Fareportal partners with over 600 airlines, 1 million lodgings, and hundreds of car rental companies worldwide. 2019 annual sales exceeded $5 billion. Fareportal sees over 150 million unique visitors annually to our desktop and mobile sites. Fareportal, with its global workforce of over 2,600 employees, is strategically positioned with 9 offices in 6 countries and headquartered in New York City. Job Overview We are seeking a proactive and knowledgeable Security Analyst to join our Information Security Operations (SecOps) team . This role will focus on SOC monitoring and Endpoint Detection and Response (EDR) using SentinelOne . The ideal candidate should have solid experience in threat monitoring, incident response, and SentinelOne tool handling. Key Responsibilities: Monitor and respond to SOC alerts and security incidents in real time. Analyze logs and alerts from SIEM and SentinelOne EDR platforms. Perform incident triage , escalation, and coordination with internal teams. Troubleshoot SentinelOne-related issues , including error resolution, agent communication, and performance problems. Understand and manage SentinelOne policies , ensure proper deployment, and make necessary adjustments for better coverage. Quickly identify the root cause of issues related to endpoint protection and take corrective actions. Coordinate with the IT team for issue resolution and endpoint remediation. Collaborate with teams to reduce false positives and improve alert accuracy. Maintain incident documentation , reports, and operational dashboards. Support in threat hunting , vulnerability detection, and other BAU (Business As Usual) security tasks. Required Skills & Qualification: Bachelors/Masters Degree in Computer Science, Information Systems, Engineering. 24 years of experience in SOC operations and endpoint security monitoring. Hands-on experience with SentinelOne EDR , including troubleshooting and policy management. Good knowledge of cybersecurity threats, incident response processes, and log analysis. Ability to investigate and resolve SentinelOne alerts and agent-related errors effectively. Experience working with SIEM tools (like Splunk, Qradar, etc.). Strong understanding of false positive tuning and threat detection improvement. Basic scripting knowledge (PowerShell, Python) is a plus. Good communication and analytical skills. Preferred Skills & Qualifications: CEH , CompTIA Security+ , or any other relevant security certification. Disclaimer This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee. Fareportal reserves the right to change the job duties, responsibilities, expectations or requirements posted here at any time at the Companys sole discretion, with or without notice.

Lead the frontline of cyber defense. Join Hitachi Cyber as a Team Lead – Security Operations Center (SOC) and take charge of protecting global organizations from today’s most advanced threats. As a global leader in cybersecurity, Hitachi Cyber empowers businesses to stay ahead of evolving risks. Based in Pune-India, you’ll lead a team of skilled analysts, work with cutting-edge tools, and play a critical role in safeguarding digital infrastructures across industries. Your Mission: As SOC Team Lead, you’ll oversee day-to-day operations, mentor analysts, and ensure rapid, effective incident response. You’ll be the bridge between tactical execution and strategic security leadership. Key Responsibilities: Lead and manage a team of SOC analysts across shifts. Oversee real-time monitoring, triage, and incident response activities. Ensure adherence to SLAs, escalation protocols, and documentation standards. Collaborate with threat intelligence, engineering, and client teams to improve detection and response. Drive continuous improvement in SOC processes, playbooks, and automation. Provide coaching, performance reviews, and training to develop team capabilities. What We’re Looking For: 5+ years of experience in cybersecurity, with at least 2 years in a SOC leadership role. Strong knowledge of SIEM tools (e.g., Splunk, Sentinel, QRadar), EDR, and incident response frameworks. Experience managing 24/7 operations and working with global clients. Excellent leadership and communication skills in English . Relevant certifications (e.g., GCIA, GCIH, CISSP, or equivalent) are a plus. Why Join Hitachi Cyber? Work with global clients and cutting-edge technologies. Be part of a collaborative, high-performance security culture. Accelerate your career in a fast-growing, mission-driven company. Ready to lead the charge? Apply now and help shape the future of cybersecurity. Show more Show less

Description and Requirements "At BMC trust is not just a word - it's a way of life!" We are an award-winning, equal opportunity, culturally diverse, fun place to be. Giving back to the community drives us to be better every single day. Our work environment allows you to balance your priorities, because we know you will bring your best every day. We will champion your wins and shout them from the rooftops. Your peers will inspire, drive, support you, and make you laugh out loud! We help our customers free up time and space to become an Autonomous Digital Enterprise that conquers the opportunities ahead - and are relentless in the pursuit of innovation! Our IS&T (Information Services and Technology) department provides all the required technology and operational support services to run our business here in BMC! We have over 200 servers on premises to support production, disaster recovery, databases, applications and over 1000 servers in Lab environment. IS&T is transformational not only for BMC but also for the customer experience, because we give a 360 degrees view to the customer about the products they should know, opportunities in the pipeline, and any service issues outstanding with the customer. We use cutting-edge technologies to manage BMC's infrastructure and showcase it to the customers – program is called BMC on BMC! We are seeking a proactive and technically capable Cyber Threat Management Engineer to join our cybersecurity threat management team. This early-career role is ideal for individuals with foundational experience in cybersecurity who are ready to grow their technical skills and contribute to BMC’s threat detection and response capabilities. You will play an integral part in identifying, analyzing, and mitigating cyber threats across BMC’s global environment. Here is how, through this exciting role, YOU will contribute to BMC's and your own success: Monitor and analyze data from security systems including open source and enterprise solutions. Effectively communicate identified threats and track remediations until completion. Participate in the investigation and technical analysis of security incidents and provide remediation guidance. Integrate threat intelligence feeds and use frameworks like MITRE ATT&CK to assess and defend against current adversary tactics. Contribute to automation initiatives to streamline threat detection, alerting, and response workflows. Support threat hunting and red team exercises. Document findings, techniques, and outcomes in knowledge bases and reports. To ensure you’re set up for success, you will bring the following skillset & experience: Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field—or equivalent hands-on experience. Foundational experience (e.g., 1–2 years) in cybersecurity operations, threat analysis, or incident response. Proficiency with at least one SIEM platform (e.g., Splunk, QRadar, Sentinel). Proficiency with enterprise solutions providing dark web monitoring, attack surface management, threat intelligence, and risk rating. Understanding of network protocols, operating systems, and cybersecurity fundamentals. Strong scripting or automation skills (e.g., Python, PowerShell, Bash) Excellent communication and documentation abilities. Whilst these are nice to have, our team can help you develop in the following skills: Familiarity with threat intelligence tools and frameworks (e.g., MISP, STIX/TAXII). Knowledge of cloud security practices (AWS, Azure, or GCP). Relevant certifications such as CompTIA Security+, CySA+, SC-200, or GIAC (GCIH, GCIA, GCTI). Curiosity for cybersecurity and continuous learning. Our commitment to you! BMC’s culture is built around its people. We have 6000+ brilliant minds working together across the globe. You won’t be known just by your employee number, but for your true authentic self. BMC lets you be YOU! If after reading the above, You’re unsure if you meet the qualifications of this role but are deeply excited about BMC and this team, we still encourage you to apply! We want to attract talents from diverse backgrounds and experience to ensure we face the world together with the best ideas! BMC is committed to equal opportunity employment regardless of race, age, sex, creed, color, religion, citizenship status, sexual orientation, gender, gender expression, gender identity, national origin, disability, marital status, pregnancy, disabled veteran or status as a protected veteran. If you need a reasonable accommodation for any part of the application and hiring process, visit the accommodation request page. < Back to search results BMC Software maintains a strict policy of not requesting any form of payment in exchange for employment opportunities, upholding a fair and ethical hiring process. At BMC we believe in pay transparency and have set the midpoint of the salary band for this role at 1,725,800 INR. Actual salaries depend on a wide range of factors that are considered in making compensation decisions, including but not limited to skill sets; experience and training, licensure, and certifications; and other business and organizational needs. The salary listed is just one component of BMC's employee compensation package. Other rewards may include a variable plan and country specific benefits. We are committed to ensuring that our employees are paid fairly and equitably, and that we are transparent about our compensation practices. ( Returnship@BMC ) Had a break in your career? No worries. This role is eligible for candidates who have taken a break in their career and want to re-enter the workforce. If your expertise matches the above job, visit to https://bmcrecruit.avature.net/returnship know more and how to apply. Show more Show less

Daily assessment of vulnerabilities identified by infrastructure scan Evaluate rate and perform risk assessments on assets Prioritizing vulnerabilities discovered along with remediation timeline s Work with associated teams to explain vulnerabilities and remediation steps as required Maintain knowledge of the threat landscape Create reports and provide analysis on vulnerabilities for technical teams and leadership Skill Required Knowledge of application network and operating system security Experience with vulnerability and patch assessment Linux and windows experience Good understanding of Windows and Linux patching Knowledge of vulnerability scoring systems CVSS CMSS Experience on vulnerability scanning tools Excellent writing and presentation skills are required in order to communicate findings and status Primary Skills VMDR Policy Compliance Qualys Tenable Nessus Rapid7 Secondary Skills Excellent writing and presentation skills are required in order to communicate findings and statusCleary communicate priorities and escalation points procedures to other team members Detail oriented organized methodical follow up skills with an analytical thought process Experience performing dynamic scans static scans and penetration testing Development experienceProject management experience Innovative and efficiency focused Track trends and configure systems as required to reduce false positives from true events

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Senior (CTM – Threat Detection & Response) KEY Capabilities: Experience in working with Splunk Enterprise, Splunk Enterprise Security & Splunk UEBA Minimum of Splunk Power User Certification Good knowledge in programming or Scripting languages such as Python (preferred), JavaScript (preferred), Bash, PowerShell, Bash, etc. Perform remote and on-site gap assessment of the SIEM solution. Define evaluation criteria & approach based on the Client requirement & scope factoring industry best practices & regulations Conduct interview with stakeholders, review documents (SOPs, Architecture diagrams etc.) Evaluate SIEM based on the defined criteria and prepare audit reports Good experience in providing consulting to customers during the testing, evaluation, pilot, production and training phases to ensure a successful deployment. Understand customer requirements and recommend best practices for SIEM solutions. Offer consultative advice in security principles and best practices related to SIEM operations Design and document a SIEM solution to meet the customer needs Experience in onboarding data into Splunk from various sources including unsupported (in-house built) by creating custom parsers Verification of data of log sources in the SIEM, following the Common Information Model (CIM) Experience in parsing and masking of data prior to ingestion in SIEM Provide support for the data collection, processing, analysis and operational reporting systems including planning, installation, configuration, testing, troubleshooting and problem resolution Assist clients to fully optimize the SIEM system capabilities as well as the audit and logging features of the event log sources Assist client with technical guidance to configure end log sources (in-scope) to be integrated to the SIEM Experience in handling big data integration via Splunk Expertise in SIEM content development which includes developing process for automated security event monitoring and alerting along with corresponding event response plans for systems Hands-on experience in development and customization of Splunk Apps & Add-Ons Builds advanced visualizations (Interactive Drilldown, Glass tables etc.) Build and integrate contextual data into notable events Experience in creating use cases under Cyber kill chain and MITRE attack framework Capability in developing advanced dashboards (with CSS, JavaScript, HTML, XML) and reports that can provide near real time visibility into the performance of client applications. Experience in installation, configuration and usage of premium Splunk Apps and Add-ons such as ES App, UEBA, ITSI etc Sound knowledge in configuration of Alerts and Reports. Good exposure in automatic lookup, data models and creating complex SPL queries. Create, modify and tune the SIEM rules to adjust the specifications of alerts and incidents to meet client requirement Work with the client SPOC to for correlation rule tuning (as per use case management life cycle), incident classification and prioritization recommendations Experience in creating custom commands, custom alert action, adaptive response actions etc. Qualification & experience: Minimum of 3 to 6 years’ experience with a depth of network architecture knowledge that will translate over to deploying and integrating a complicated security intelligence solution into global enterprise environments. Strong oral, written and listening skills are an essential component to effective consulting. Strong background in network administration. Ability to work at all layers of the OSI models, including being able to explain communication at any level is necessary. Must have knowledge of Vulnerability Management, Windows and Linux basics including installations, Windows Domains, trusts, GPOs, server roles, Windows security policies, user administration, Linux security and troubleshooting. Good to have below mentioned experience with designing and implementation of Splunk with a focus on IT Operations, Application Analytics, User Experience, Application Performance and Security Management Multiple cluster deployments & management experience as per Vendor guidelines and industry best practices Troubleshoot Splunk platform and application issues, escalate the issue and work with Splunk support to resolve issues Certification in any one of the SIEM Solution such as IBM QRadar, Exabeam, Securonix will be an added advantage Certifications in a core security related discipline will be an added advantage. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today. Show more Show less

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Senior (CTM – Threat Detection & Response) KEY Capabilities: Experience in working with Splunk Enterprise, Splunk Enterprise Security & Splunk UEBA Minimum of Splunk Power User Certification Good knowledge in programming or Scripting languages such as Python (preferred), JavaScript (preferred), Bash, PowerShell, Bash, etc. Perform remote and on-site gap assessment of the SIEM solution. Define evaluation criteria & approach based on the Client requirement & scope factoring industry best practices & regulations Conduct interview with stakeholders, review documents (SOPs, Architecture diagrams etc.) Evaluate SIEM based on the defined criteria and prepare audit reports Good experience in providing consulting to customers during the testing, evaluation, pilot, production and training phases to ensure a successful deployment. Understand customer requirements and recommend best practices for SIEM solutions. Offer consultative advice in security principles and best practices related to SIEM operations Design and document a SIEM solution to meet the customer needs Experience in onboarding data into Splunk from various sources including unsupported (in-house built) by creating custom parsers Verification of data of log sources in the SIEM, following the Common Information Model (CIM) Experience in parsing and masking of data prior to ingestion in SIEM Provide support for the data collection, processing, analysis and operational reporting systems including planning, installation, configuration, testing, troubleshooting and problem resolution Assist clients to fully optimize the SIEM system capabilities as well as the audit and logging features of the event log sources Assist client with technical guidance to configure end log sources (in-scope) to be integrated to the SIEM Experience in handling big data integration via Splunk Expertise in SIEM content development which includes developing process for automated security event monitoring and alerting along with corresponding event response plans for systems Hands-on experience in development and customization of Splunk Apps & Add-Ons Builds advanced visualizations (Interactive Drilldown, Glass tables etc.) Build and integrate contextual data into notable events Experience in creating use cases under Cyber kill chain and MITRE attack framework Capability in developing advanced dashboards (with CSS, JavaScript, HTML, XML) and reports that can provide near real time visibility into the performance of client applications. Experience in installation, configuration and usage of premium Splunk Apps and Add-ons such as ES App, UEBA, ITSI etc Sound knowledge in configuration of Alerts and Reports. Good exposure in automatic lookup, data models and creating complex SPL queries. Create, modify and tune the SIEM rules to adjust the specifications of alerts and incidents to meet client requirement Work with the client SPOC to for correlation rule tuning (as per use case management life cycle), incident classification and prioritization recommendations Experience in creating custom commands, custom alert action, adaptive response actions etc. Qualification & experience: Minimum of 3 to 6 years’ experience with a depth of network architecture knowledge that will translate over to deploying and integrating a complicated security intelligence solution into global enterprise environments. Strong oral, written and listening skills are an essential component to effective consulting. Strong background in network administration. Ability to work at all layers of the OSI models, including being able to explain communication at any level is necessary. Must have knowledge of Vulnerability Management, Windows and Linux basics including installations, Windows Domains, trusts, GPOs, server roles, Windows security policies, user administration, Linux security and troubleshooting. Good to have below mentioned experience with designing and implementation of Splunk with a focus on IT Operations, Application Analytics, User Experience, Application Performance and Security Management Multiple cluster deployments & management experience as per Vendor guidelines and industry best practices Troubleshoot Splunk platform and application issues, escalate the issue and work with Splunk support to resolve issues Certification in any one of the SIEM Solution such as IBM QRadar, Exabeam, Securonix will be an added advantage Certifications in a core security related discipline will be an added advantage. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today. Show more Show less

ROLES & RESPONSIBILITIES Reviews alerts generated by SentinelOne and implements appropriate containment and mitigation measures Proficient in SIEM, with a focus on QRadar SIEM, as well as threat monitoring and hunting within SIEM environments. Analyzes payloads using JoeSandbox and escalates to the appropriate team as necessary Collaborates with the Forensics team to conduct threat hunting using identified Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs) Assists the Tiger Team in targeted collections of systems based on identified malicious activities in the client's environment Conducts historical log reviews to support threat hunting efforts and ensures all malicious artifacts are mitigated in the SentinelOne console Examines client-provided documents and files to supplement the SOC investigation and mitigation strategy Conducts perimeter scans of client infrastructure and reports any identified vulnerabilities to the Tiger Team for appropriate escalation Manages client-related tasks within the ConnectWise Manage ticketing system as part of the Client Handling Lifecycle Creates user accounts in SentinelOne console for the client Generates Threat Reports showcasing activity observed within the SentinelOne product Executes passphrase exports as needed for client offboarding Submits legacy installer requests to ensure the team is properly equipped for deployment Provides timely alert notifications to the IR team of any malicious activity impacting our clients Assists with uninstalling/migrating SentinelOne Generates Ranger reports to provide needed visibility into client environments Manages and organizes client assets (multi-site and multi-group accounts) Applies appropriate interoperability exclusions relating to SentinelOne and client applications Performs SentinelOne installation / interoperability troubleshooting as needed Contributes to the overall documentation of SOC processes and procedures Participates in “Handler on Duty (HOD) shifts as assigned to support the TT client matters Internally escalates support ticket / alerts to Tier II-IV Analysts as needed May perform other duties as assigned by management SKILLS AND KNOWLEDGE Demonstrated knowledge of Windows and Unix operating systems Thorough understanding of Digital Forensics and Incident Response practices Proficiency in advanced analysis techniques for processing and reviewing large datasets in various formats Familiarity with TCP/IP and OSI Model concepts at a basic level Expertise in the Incident Response Life Cycle stages (Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned) Working knowledge of the MITRE ATT&CK framework at an intermediate level Proven ability to work independently and solve complex problems with little direction from management Highly detail-oriented and committed to producing quality work JOB REQUIREMENTS Associate’s degree and 6+ years of IT related experience or Bachelor’s Degree and 2-5 years related experience Current or previous knowledge of, or previous experience with, Endpoint Detection and Response (EDR) toolsets General knowledge of the Incident Handling Lifecycle Ability to communicate in both technical and non-technical terms both oral and written DISCLAIMER The above statements are intended to describe the general nature and level of work being performed. They are not intended to be an exhaustive list of all responsibilities, duties and skills required personnel so classified. WORK ENVIRONMENT While performing the responsibilities of this position, the work environment characteristics listed below are representative of the environment the employee will encounter: Usual office working conditions. Reasonable accommodation may be made to enable people with disabilities to perform the essential functions of this job. PHYSICAL DEMANDS No physical exertion required Travel within or outside of the state Light work: Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force as frequently as needed to move objects TERMS OF EMPLOYMENT Salary and benefits shall be paid consistent with Arete salary and benefit policy. FLSA OVERTIME CATEGORY Job is exempt from the overtime provisions of the Fair Labor Standards Act. DECLARATION The Arete Incident Response Human Resources Department retains the sole right and discretion to make changes to this job description. EQUAL EMPLOYMENT OPPORTUNITY We’re proud to be an equal opportunity employer- and celebrate our employees’ differences, regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or Veteran status. Different makes us better. #LI Arete Incident Response is an outstanding (and growing) company with a very dedicated, fun team. We offer competitive salaries, fully paid benefits including Medical/Dental, Life/Disability Insurance, 401(k) and the opportunity to work with some of the latest and greatest in the fast-growing cyber security industry. When you join Arete… You’ll be doing work that matters alongside other talented people, transforming the way people, businesses, and things connect with each other. Of course, we will offer you great pay and benefits, but we’re about more than that. Arete is a place where you can craft your own path to greatness. Whether you think in code, words, pictures or numbers, find your future at Arete, where experience matters. Equal Employment Opportunity We’re proud to be an equal opportunity employer- and celebrate our employees’ differences, regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or Veteran status. Different makes us better. About Us Arete Incident Response is an elite team of the world’s leading cybersecurity and digital forensics experts who combat today’s sophisticated cyberattacks. We work tirelessly to provide unparalleled capabilities and solutions throughout the entire cyber incident life cycle. These include incident response readiness assessments and penetration tests as well as post-incident response, remediation, containment, and eradication services. We work in close collaboration with industry leaders and government agencies along with leading cybersecurity technology platforms to deliver an innovative, intelligence-based approach to solving our client’s toughest challenges. If you want to work with the most talented and experienced people in the industry with the desire to be a cyber hunter and industry expert, we want you to be a part of our team.

The remote work revolution is here to stay, especially in the tech industry. With Hyderabad fast becoming a major technology hub in India, there’s a massive surge in demand for high-paying work-from-home jobs for tech professionals. Whether you’re a software engineer, cloud architect, data analyst, or cybersecurity expert, companies are actively seeking skilled professionals who can work remotely. In this article, we’ll explore the top-paying WFH jobs for tech professionals in Hyderabad , the skills you need , companies hiring in 2025 , and answers to your most asked questions. 🌐 Why Tech Professionals Prefer Remote Work Work-from-home jobs offer more than just comfort and convenience. Here’s why tech professionals in Hyderabad are choosing remote roles: Higher salaries from international and pan-India companies Flexible schedules to balance work-life Opportunity to freelance or consult multiple clients No relocation or commute costs Access to global projects without leaving home 🧑‍💻 Top High-Paying Work from Home Jobs for Tech Professionals in Hyderabad Below are the most in-demand and well-paying remote jobs in Hyderabad for experienced and skilled techies. Full Stack Developer Overview: Tech companies are always hiring skilled full stack developers who can work on both frontend and backend development. Skills Required: HTML, CSS, JavaScript Node.js, React, Angular MongoDB, MySQL Git, RESTful APIs Top Employers: TCS Accenture Infosys Zoho Average Salary (Remote): ₹10–20 LPA Cloud Solutions Architect Overview: Cloud computing roles are in high demand with companies moving infrastructure to the cloud. Skills Required: AWS, Microsoft Azure, Google Cloud DevOps & Infrastructure as Code (IaC) Kubernetes, Docker Load balancing and cloud security Companies Hiring: Amazon Web Services (AWS) Tech Mahindra Microsoft Startups using microservices architecture Average Salary: ₹15–30 LPA Also Read: Best Work from Home Jobs in Hyderabad for Freshers and College Students Data Scientist / ML Engineer Overview: Data is the new oil, and Hyderabad companies are investing in predictive analytics, AI, and machine learning. Skills Required: Python, R TensorFlow, PyTorch SQL, Hadoop Data visualization tools (Tableau, Power BI) Top Recruiters: Deloitte Invesco Fractal Analytics Startups in fintech & healthtech Average Salary: ₹12–25 LPA Cybersecurity Analyst Overview: With remote work growing, cybersecurity experts are essential for data protection and risk management. Skills Required: Network security Firewalls, IDS/IPS Ethical hacking, penetration testing SIEM tools like Splunk, IBM QRadar Top Hiring Companies: HCL Technologies PwC Cognizant Global MNCs with security ops centers (SOCs) Average Salary: ₹10–22 LPA DevOps Engineer Overview: DevOps experts bridge the gap between development and operations, automating the deployment process. Skills Required: Jenkins, Docker, Kubernetes Terraform, Ansible CI/CD pipelines Git, scripting (Shell/Python) Hiring Companies: Accenture IBM Zensar SaaS startups Average Salary: ₹12–24 LPA Blockchain Developer Overview: With increased focus on Web3 and fintech in Hyderabad, blockchain is now a lucrative remote field. Skills Required: Solidity, Ethereum Smart contract development Web3.js, IPFS Crypto wallets and dApps Companies Hiring: CoinDCX WazirX Emerging fintech & Web3 startups Average Salary: ₹15–28 LPA AI / NLP Engineer Overview: Natural Language Processing is being used across chatbots, voice assistants, and automation tools. Skills Required: Python, spaCy, NLTK Transformers, HuggingFace Deep learning, BERT, GPT Top Employers: Google Hyderabad AI startups EdTech platforms Average Salary: ₹14–30 LPA Remote QA Automation Engineer Overview: Automation testers are crucial in agile development to ensure faster delivery and minimal bugs. Skills Required: Selenium, Cypress JMeter, Postman Jenkins, Maven Java, Python scripting Companies Hiring: Infosys Cognizant Product-based startups Average Salary: ₹8–18 LPA Remote Product Manager (Tech) Overview: For those with both technical and managerial acumen, PM roles are rewarding and fully remote in many firms. Skills Required: Agile methodologies JIRA, Asana UI/UX understanding Communication & leadership Companies Hiring: SaaS startups Healthtech firms Remote-first companies Average Salary: ₹20–35 LPA Freelance Tech Consultant Overview: Senior-level professionals often choose freelancing for better flexibility and pay per project. Services Offered: Software architecture Cloud migration Technical training & mentorship Best Platforms: Toptal Upwork Freelancer Earning Potential: ₹50,000 – ₹3 lakhs/month depending on projects Also Read: Genuine Work from Home Jobs in Kolkata Without Investment 💼 Top Companies Offering Remote Tech Jobs in Hyderabad (2025) Here’s a look at companies actively hiring tech professionals remotely: Company Roles Available Remotely TCS Full stack, Cloud, Testing, DevOps Cognizant Cybersecurity, Automation, Data Analytics Microsoft Azure, AI/ML, Product, QA Amazon India Cloud, NLP, Product Management Tech Mahindra DevOps, Security, Full Stack Accenture Data science, QA, Agile management Zoho Frontend, Backend, Cloud Invesco BI, Analytics, Cybersecurity Infosys Java, Python, QA Automation Technical Skills: 📚 Skills Needed for High-Paying Remote Tech Jobs Proficiency in modern programming languages Cloud technologies (AWS, Azure, GCP) CI/CD tools and automation platforms Machine learning and data analysis Cybersecurity frameworks Soft Skills: Communication and collaboration Remote work discipline Problem-solving abilities Time management Self-motivation and adaptability 🛠 Tools That Tech Professionals Should Master for Remote Work Tool / Platform Purpose GitHub / GitLab Version control and collaboration Slack / Microsoft Teams Team communication Zoom / Google Meet Video conferencing JIRA / Trello Project management Docker / Kubernetes Containerization and orchestration AWS / Azure Cloud services 📍 How to Find High-Paying Remote Tech Jobs in Hyderabad LinkedIn Use filters like “Remote” + “Hyderabad” in job search Connect with hiring managers and recruiters Naukri.com Create alerts for WFH roles Search roles by skill + remote (e.g., “AWS Developer remote”) AngelList (Wellfound) Great for startup jobs with high pay and equity options Toptal & Upwork For freelancers & consultants looking for global clients Company Career Pages Visit tech companies’ job portals and apply for remote listings 🚀 Tips to Land High-Paying Remote Tech Jobs Build a Strong GitHub Portfolio showcasing real projects Get Certified in AWS, Azure, Data Science, or Cybersecurity Update your LinkedIn with remote-ready skills Learn Communication Tools used by remote teams (Slack, Teams) Attend Virtual Tech Conferences to network with remote-first companies Highlight Remote Work Skills on your resume Prepare for Virtual Interviews with good camera setup and environment 🏁 Conclusion – High-Paying Work from Home Jobs in Hyderabad Remote work has become a reality — and Hyderabad, being a major tech city, is offering a goldmine of opportunities for tech professionals who prefer working from home. Whether you’re a developer, data analyst, cybersecurity expert, or DevOps engineer, there’s a high-paying work-from-home job waiting for you . By sharpening your skills, leveraging online platforms, and aligning with the needs of remote-first companies, you can build a successful tech career from the comfort of your home in Hyderabad. ❓ FAQs – High-Paying Work from Home Jobs in Hyderabad What are the best high-paying WFH jobs for techies in Hyderabad? Full stack developers, cloud architects, ML engineers, and DevOps engineers are some of the top-paying remote roles. Can I work remotely for international companies from Hyderabad? Yes. Platforms like Toptal, Upwork, and GitHub Jobs allow Indian professionals to work for global clients. What’s the minimum experience needed for high-paying remote jobs? Most roles require 2–5 years of experience, though startups often hire based on skills and projects. How do I verify if a remote tech job offer is genuine? Check company credentials, look for official email domains, and avoid paying any registration fees. Are cybersecurity roles available remotely? Absolutely. Many companies hire remote security analysts, penetration testers, and SOC professionals. How much can a cloud architect earn working from home? In Hyderabad, cloud architects working remotely can earn ₹15–30 LPA or more depending on skills and certifications. Which certifications help in getting high-paying WFH tech jobs? AWS Certified Solutions Architect, Azure Fundamentals, Google Cloud Engineer, Certified Ethical Hacker, and PMP. Is freelancing a good option for experienced tech professionals? Yes. Freelancing offers flexibility and competitive international pay, especially for experienced consultants. Are remote roles full-time or contract-based? Both. Many companies offer full-time remote roles with benefits, while others hire on a contract basis. What are the challenges of remote work in tech? Time zone differences, communication gaps, and the need for self-discipline. These can be managed with proper planning. Related Posts: Top Work from Home Jobs in Hyderabad Hiring Now Top 10 Remote Customer Service Jobs You Can Start Today The Pros and Cons of Working Remote Data Entry Jobs How to Land Your First Remote Entry-Level Job: Tips and Tricks How to Thrive in Remote Customer Service Jobs: Tips for Success Best Remote Customer Success Jobs You Can Work From Anywhere Top Remote Front End Developer Jobs Hiring in 2025 Top 10 Work from Home Jobs in Delhi Hiring Now Show more Show less

About Gruve Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks. About The Role We are seeking a skilled SIEM Administrator to manage and optimize different SIEM solutions. The ideal candidate will be responsible for system administration, log integration, troubleshooting, Deployment, Implementation and maintaining security posture for the organization. Key Responsibilities SIEM Administration: Install, configure, maintain, and upgrade SIEM components. (IBM Qradar SIEM, DNIF, Splunk & Securonix). Log Management Onboard, parse, and normalize logs from various data sources (firewalls, servers, databases, applications, etc.) Custom log source integration and parser development. System Monitoring & Troubleshooting Ensure SIEM tools are functioning optimally. Monitor & regular health check perform for SIEM tools. troubleshoot system errors and resolve performance issues. Conduct regular performance tuning and capacity planning Perform root cause analysis for system failures & performance issues. Optimize system performance and storage management for SIEM Integration & Automation Integrate third-party security tools (firewalls, EDR, threat intelligence feeds) with SIEM. Compliance & Audits Ensure log retention policies comply with regulatory standards. Develop & enforce SIEM access controls & user roles/permissions. Documentation & Training Document system configurations, SOP’s & troubleshooting documents. Prepare monthly/ weekly reports and PPT, onboarding documentation as per business/ client requirement. Dashboard & Report Development Create & maintain custom dashboards & reports Optimize searches & reports for performance and efficiency. Hands on experience with Linux OS & Windows OS Basic to mediator level knowledge in networking skills Should be familiar with Azure, AWS or GCP products Basic Qualifications B.E./B.Tech in Computers or related field (preferred). 4+ Years of Experience in SOC Administration. Strong knowledge of SIEM architecture, log sources, and event correlation. Preferred Qualifications Proficiency in log management, regular expressions, and network security concepts. Experience integrating SIEM with various security tools (firewalls, IDS/IPS, antivirus, etc.) Scripting knowledge (Python, Bash, or PowerShell) is a plus. Training or Certificate on Splunk or IBM Qradar Preferred. Experience with SIEM tools like IBM QRadar, Splunk, Securonix, LogRhythm, Microsoft Sentinel, DNIF etc. Proficiency in IBM Qradar & Splunk administration. Configuring, maintaining, and troubleshooting SIEM solutions. Strong analytical and problem-solving skills. Excellent communication and documentation abilities. Why Gruve At Gruve, we foster a culture of innovation, collaboration, and continuous learning. We are committed to building a diverse and inclusive workplace where everyone can thrive and contribute their best work. If you’re passionate about technology and eager to make an impact, we’d love to hear from you. Gruve is an equal opportunity employer. We welcome applicants from all backgrounds and thank all who apply; however, only those selected for an interview will be contacted. Show more Show less

Company Overview Team Geek Solutions is a dynamic IT solutions provider located in India, dedicated to delivering innovative and efficient technology services. Our mission is to empower businesses by harnessing cutting-edge technologies that drive growth and enhance operational efficiency. We value creativity, teamwork, and a commitment to excellence in everything we do. Our culture is rooted in collaboration and continuous learning, making Team Geek Solutions a fantastic place to advance your career in technology. Job Description We are looking for a Python Developer to join our cutting-edge development team as it grows. We want someone who is comfortable asking “why?” The ideal candidate is a divergent thinker who understands industry best practices and has experience with multiple coding languages. They are a team player possessing good analytical as well as technical skills. They are able to communicate and understand the logic behind technical decisions to non-tech stakeholders. They must be comfortable working in an agile environment and have the ability to “take the wheel” when necessary. Responsibilities Gather and analyze user requirements. Create clear technical specifications for reference and reporting. Analyze the third-party applications and identify the components to be integrated. Create innovative, scalable, fault-tolerant software solutions for our customers. Validate and ensure defined unit tests code coverage is achieved. Do code quality checks and code reviews regularly to ensure safe and efficient code. Ensure the setup of the deployment infrastructure and test environments. Work closely with project managers, teams, systems architects, and sales and marketing professionals to deliver project objectives. Continuously look to improve the organization's standards. Expand existing software to meet the changing needs of our key demographics. Requirements Mandatory Skills: Added Advantage Good to have skills: A Bachelor’s / Master’s Degree in Engineering or Information Technology. 5-7 years of software development experience with 4+ years of experience with the Python programming language. A thorough understanding of computer architecture, operating systems, and data structures. An in-depth understanding of the Internet, Cloud Computing & Services, and REST APIs. Must have experience with any one of the python frameworks like Flask / FastAPI / Django REST. Must know GIT and Python virtual environment. Must have experience with python requests module. Should have experience with creating and using python third-party libraries. Familiarity with SIEM tools like the Qradar app / Splunk app and Splunk add-on will be an advantage. Experience working with Linux/Unix and shell scripts. A meticulous and organized approach to work. A logical, analytical, and creative approach to problem-solving. A thorough, detail-oriented work style. Skills: rest,splunk add-on,unix,django rest,siem tools,flask,fastapi,django,git,unit testing,python virtual environment,qradar app,restful apis,agile methodologies,splunk app,shell scripts,linux,python requests module,python,aws,azure,google cloud platform Show more Show less

Roles & Responsibilities Reviews alerts generated by SentinelOne and implements appropriate containment and mitigation measures Proficient in SIEM, with a focus on QRadar SIEM, as well as threat monitoring and hunting within SIEM environments. Analyzes payloads using JoeSandbox and escalates to the appropriate team as necessary Collaborates with the Forensics team to conduct threat hunting using identified Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs) Assists the Tiger Team in targeted collections of systems based on identified malicious activities in the client's environment Conducts historical log reviews to support threat hunting efforts and ensures all malicious artifacts are mitigated in the SentinelOne console Examines client-provided documents and files to supplement the SOC investigation and mitigation strategy Conducts perimeter scans of client infrastructure and reports any identified vulnerabilities to the Tiger Team for appropriate escalation Manages client-related tasks within the ConnectWise Manage ticketing system as part of the Client Handling Lifecycle Creates user accounts in SentinelOne console for the client Generates Threat Reports showcasing activity observed within the SentinelOne product Executes passphrase exports as needed for client offboarding Submits legacy installer requests to ensure the team is properly equipped for deployment Provides timely alert notifications to the IR team of any malicious activity impacting our clients Assists with uninstalling/migrating SentinelOne Generates Ranger reports to provide needed visibility into client environments Manages and organizes client assets (multi-site and multi-group accounts) Applies appropriate interoperability exclusions relating to SentinelOne and client applications Performs SentinelOne installation / interoperability troubleshooting as needed Contributes to the overall documentation of SOC processes and procedures Participates in “Handler on Duty (HOD) shifts as assigned to support the TT client matters Internally escalates support ticket / alerts to Tier II-IV Analysts as needed May perform other duties as assigned by management Skills And Knowledge Demonstrated knowledge of Windows and Unix operating systems Thorough understanding of Digital Forensics and Incident Response practices Proficiency in advanced analysis techniques for processing and reviewing large datasets in various formats Familiarity with TCP/IP and OSI Model concepts at a basic level Expertise in the Incident Response Life Cycle stages (Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned) Working knowledge of the MITRE ATT&CK framework at an intermediate level Proven ability to work independently and solve complex problems with little direction from management Highly detail-oriented and committed to producing quality work Job Requirements Associate’s degree and 6+ years of IT related experience or Bachelor’s Degree and 2-5 years related experience Current or previous knowledge of, or previous experience with, Endpoint Detection and Response (EDR) toolsets General knowledge of the Incident Handling Lifecycle Ability to communicate in both technical and non-technical terms both oral and written DISCLAIMER The above statements are intended to describe the general nature and level of work being performed. They are not intended to be an exhaustive list of all responsibilities, duties and skills required personnel so classified. WORK ENVIRONMENT While performing the responsibilities of this position, the work environment characteristics listed below are representative of the environment the employee will encounter: Usual office working conditions. Reasonable accommodation may be made to enable people with disabilities to perform the essential functions of this job. PHYSICAL DEMANDS No physical exertion required Travel within or outside of the state Light work: Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force as frequently as needed to move objects TERMS OF EMPLOYMENT Salary and benefits shall be paid consistent with Arete salary and benefit policy. FLSA OVERTIME CATEGORY Job is exempt from the overtime provisions of the Fair Labor Standards Act. DECLARATION The Arete Incident Response Human Resources Department retains the sole right and discretion to make changes to this job description. EQUAL EMPLOYMENT OPPORTUNITY We’re proud to be an equal opportunity employer- and celebrate our employees’ differences, regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or Veteran status. Different makes us better. Arete Incident Response is an outstanding (and growing) company with a very dedicated, fun team. We offer competitive salaries, fully paid benefits including Medical/Dental, Life/Disability Insurance, 401(k) and the opportunity to work with some of the latest and greatest in the fast-growing cyber security industry. When you join Arete… You’ll be doing work that matters alongside other talented people, transforming the way people, businesses, and things connect with each other. Of course, we will offer you great pay and benefits, but we’re about more than that. Arete is a place where you can craft your own path to greatness. Whether you think in code, words, pictures or numbers, find your future at Arete, where experience matters. Equal Employment Opportunity We’re proud to be an equal opportunity employer- and celebrate our employees’ differences, regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or Veteran status. Different makes us better. Show more Show less

Skills: SIEM Tools, Intrusion Detection Systems, Incident Response, Threat Intelligence Platforms, Endpoint Detection and Response, Network Traffic Analysis, Log Analysis, Vulnerability Assessment Tools, Qualifications BE/ B.Tech/ M.Tech/ MCA with 60%+ throughout the academics. Security certifications like CEH or equivalent preferred. Experience And Skillset Minimum 2 +years hands-on experience with one or more SIEM tools (Log Logic, LogRhythm, Splunk, QRadar, ArcSight etc.). In-depth understanding of security threats (preferably OWASP Top 10 vulnerabilities), threat attack methods and the current threat environment. Proficient in Incident Management and Response. Basic knowledge of Windows and Unix environments. Knowledge of OSI Model, TCP/IP Protocols, network security. Knowledge about other security tools like Packet Analyzers, HIPS/NIPS, Network Monitoring tools, Cloud Security, AV, EDR, WAF etc. Responsibilities Responsible for working in a 24x7 Security Operation center (SOC) environment. Carry out investigation and correlation and work with the stakeholders towards mitigation and closure of security incidents. Monitor various dash boards from different security solutions on shift basis. Work with the engineering team for Sensor and SIEM rules fine-tuning. Prepare various management reports from SIEM and other security solutions. Provide analysis and trending of security log data from a large number of heterogeneous security devices. Provide threat and vulnerability analysis as well as security advisory services. Analyze and respond to previously undisclosed software and hardware vulnerabilities. Investigate, document, and report on information security issues and emerging trends. Seamlessly integrate with the team work culture, ensure proper information flow across shifts, prepare/take part in shift handovers. Communicate effectively by contributing significantly to the development and delivery of a variety of written and visual documents for diverse audiences. Location Navi Mumbai (On-Site) Show more Show less

Skills: SIEM Tools, Intrusion Detection Systems, Incident Response, Threat Intelligence Platforms, Endpoint Detection and Response, Network Traffic Analysis, Log Analysis, Vulnerability Assessment Tools, Qualifications BE/ B.Tech/ M.Tech/ MCA with 60%+ throughout the academics. Security certifications like CEH or equivalent preferred. Experience And Skillset Minimum 2 +years hands-on experience with one or more SIEM tools (Log Logic, LogRhythm, Splunk, QRadar, ArcSight etc.). In-depth understanding of security threats (preferably OWASP Top 10 vulnerabilities), threat attack methods and the current threat environment. Proficient in Incident Management and Response. Basic knowledge of Windows and Unix environments. Knowledge of OSI Model, TCP/IP Protocols, network security. Knowledge about other security tools like Packet Analyzers, HIPS/NIPS, Network Monitoring tools, Cloud Security, AV, EDR, WAF etc. Responsibilities Responsible for working in a 24x7 Security Operation center (SOC) environment. Carry out investigation and correlation and work with the stakeholders towards mitigation and closure of security incidents. Monitor various dash boards from different security solutions on shift basis. Work with the engineering team for Sensor and SIEM rules fine-tuning. Prepare various management reports from SIEM and other security solutions. Provide analysis and trending of security log data from a large number of heterogeneous security devices. Provide threat and vulnerability analysis as well as security advisory services. Analyze and respond to previously undisclosed software and hardware vulnerabilities. Investigate, document, and report on information security issues and emerging trends. Seamlessly integrate with the team work culture, ensure proper information flow across shifts, prepare/take part in shift handovers. Communicate effectively by contributing significantly to the development and delivery of a variety of written and visual documents for diverse audiences. Location Navi Mumbai (On-Site) Show more Show less

Area(s) of responsibility About Us Birlasoft, a global leader at the forefront of Cloud, AI, and Digital technologies, seamlessly blends domain expertise with enterprise solutions. The company’s consultative and design-thinking approach empowers societies worldwide, enhancing the efficiency and productivity of businesses. As part of the multibillion-dollar diversified CKA Birla Group, Birlasoft with its 12,000+ professionals, is committed to continuing the Group’s 170-year heritage of building sustainable communities. Job Title: Advanced Threat Management, Security Design, and Implementation Architect Job Summary: We are seeking a highly experienced Advanced Threat Management, Security Design, and Implementation Architect to lead our efforts in developing and deploying cutting-edge security solutions. The successful candidate will have deep expertise in advanced threat management, security architecture, and the implementation of robust security frameworks to protect an organization's critical assets. Key Responsibilities Design and implement advanced threat management strategies to identify, mitigate, and respond to security threats. Develop and maintain comprehensive security architectures that align with business goals and regulatory requirements. Lead security design initiatives for new and existing systems, ensuring robust protection against cyber threats. Oversee the implementation of security controls, policies, and procedures across the organization. In-depth knowledge of XDR Technology, SIEM, SOAR, SOC Architecture, Infrastructure and Data Security, Advisory and GRC Processes. Outstanding problem-solving skills and a strategic, analytical mindset, and be able to decipher the complex cybersecurity landscapes. Conduct strategies for vulnerability management and lead initiatives around effective VM in the organization. Collaborate with cross-functional teams to integrate security into the software development lifecycle (SDLC). Provide expert guidance on the latest security trends, tools, and technologies to enhance the organization’s security posture. Develop and deliver training programs to educate employees on security best practices and threat management. Ensure compliance with industry standards, regulations, and frameworks (e.g., NIST, ISO 27001). Professionalism, integrity, and a commitment to maintaining the highest ethical standards in conducting professional responsibilities Required Qualifications Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field. 10+ years of experience in advanced threat management, security design, and implementation. Proven expertise in developing and implementing security architectures and frameworks. Strong understanding of security assessment methodologies, vulnerability analysis, and penetration testing. Experience with security tools such as SIEM, SOAR, EDR, VM, Unified VM, ZTNA, IDS/IPS, firewalls, and endpoint protection, EASM, Deep/ Dark Web and Brand Protection. Excellent problem-solving skills and attention to detail. Strong communication and leadership skills. Experience with cloud security and securing hybrid environments. Preferred Qualifications Master’s degree in Information Security or a related field. Preferred certification in multiple SIEM and SOAR solution implementation (MS Sentinel, Splunk, Phantom, Swimlane, QRADAR) Relevant certifications such as CISSP, CISM, CEH, or OSCP. Show more Show less

Company Overview Interactive Brokers Group, Inc. (Nasdaq: IBKR) is a global financial services company headquartered in Greenwich, CT, USA, with offices in over 15 countries. We have been at the forefront of financial innovation for over four decades, known for our cutting-edge technology and client commitment. IBKR affiliates provide global electronic brokerage services around the clock on stocks, options, futures, currencies, bonds, and funds to clients in over 200 countries and territories. We serve individual investors and institutions, including financial advisors, hedge funds and introducing brokers. Our advanced technology, competitive pricing, and global market help our clients to make the most of their investments. Barron's has recognized Interactive Brokers as the #1 online broker for six consecutive years. Join our dynamic, multi-national team and be a part of a company that simplifies and enhances financial opportunities using state-of-the-art technology. Position Overview Seeking a Security Analyst to join our Security Operations Center (SOC), focusing on incident response and threat detection. This role involves working with enterprise SIEM platforms, EDR solutions, and incident management tools to protect IBKR's global trading infrastructure. Key Responsibilities Triage and investigate security alerts using SIEM/EDR tools Execute incident response playbooks Perform malware analysis and IOC identification Create incident tickets and maintain documentation Conduct initial forensic data collection Support security event correlation and analysis Monitor suspicious endpoint activities Participate in 24x7 incident response coverage Required Technical Skills Experience with SIEM (Splunk/QRadar) EDR platforms (CrowdStrike/Carbon Black) Incident ticketing systems (ServiceNow/JIRA) Windows/Linux log analysis Network traffic analysis Malware detection tools IOC collection and analysis Basic forensic tools Required Experience 2-3 years SOC/IR experience L1/L2 alert analysis background Experience with incident playbooks Exposure to MITRE ATT&CK framework Understanding of kill chain methodology Basic threat intelligence usage Technical Environment SIEM platforms EDR solutions TIP platforms Forensic tools Network monitoring tools Vulnerability scanners Incident management systems Work Requirements Rotating shifts (24x7 SOC) Incident response handling Alert triage and escalation Documentation and reporting Team collaboration Growth Path Advanced IR certification support Threat hunting training Digital forensics exposure Technical skill development Senior analyst progression Company Benefits & Perks Competitive salary package. Performance-based annual bonus (cash and stocks). Hybrid working model (3 days office/week). Group Medical & Life Insurance. Modern offices with free amenities & fully stocked cafeterias. Monthly food card & company-paid snacks. Hardship/shift allowance with company-provided pickup & drop facility* Attractive employee referral bonus. Frequent company-sponsored team-building events and outings. Depending upon the shifts. The benefits package is subject to change at the management's discretion. Show more Show less

Area(s) of responsibility About Us Birlasoft, a global leader at the forefront of Cloud, AI, and Digital technologies, seamlessly blends domain expertise with enterprise solutions. The company’s consultative and design-thinking approach empowers societies worldwide, enhancing the efficiency and productivity of businesses. As part of the multibillion-dollar diversified CKA Birla Group, Birlasoft with its 12,000+ professionals, is committed to continuing the Group’s 170-year heritage of building sustainable communities. Job Title: Advanced Threat Management, Security Design, and Implementation Architect Job Summary: We are seeking a highly experienced Advanced Threat Management, Security Design, and Implementation Architect to lead our efforts in developing and deploying cutting-edge security solutions. The successful candidate will have deep expertise in advanced threat management, security architecture, and the implementation of robust security frameworks to protect an organization's critical assets. Key Responsibilities Design and implement advanced threat management strategies to identify, mitigate, and respond to security threats. Develop and maintain comprehensive security architectures that align with business goals and regulatory requirements. Lead security design initiatives for new and existing systems, ensuring robust protection against cyber threats. Oversee the implementation of security controls, policies, and procedures across the organization. In-depth knowledge of XDR Technology, SIEM, SOAR, SOC Architecture, Infrastructure and Data Security, Advisory and GRC Processes. Outstanding problem-solving skills and a strategic, analytical mindset, and be able to decipher the complex cybersecurity landscapes. Conduct strategies for vulnerability management and lead initiatives around effective VM in the organization. Collaborate with cross-functional teams to integrate security into the software development lifecycle (SDLC). Provide expert guidance on the latest security trends, tools, and technologies to enhance the organization’s security posture. Develop and deliver training programs to educate employees on security best practices and threat management. Ensure compliance with industry standards, regulations, and frameworks (e.g., NIST, ISO 27001). Professionalism, integrity, and a commitment to maintaining the highest ethical standards in conducting professional responsibilities Required Qualifications Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field. 10+ years of experience in advanced threat management, security design, and implementation. Proven expertise in developing and implementing security architectures and frameworks. Strong understanding of security assessment methodologies, vulnerability analysis, and penetration testing. Experience with security tools such as SIEM, SOAR, EDR, VM, Unified VM, ZTNA, IDS/IPS, firewalls, and endpoint protection, EASM, Deep/ Dark Web and Brand Protection. Excellent problem-solving skills and attention to detail. Strong communication and leadership skills. Experience with cloud security and securing hybrid environments. Preferred Qualifications Master’s degree in Information Security or a related field. Preferred certification in multiple SIEM and SOAR solution implementation (MS Sentinel, Splunk, Phantom, Swimlane, QRADAR) Relevant certifications such as CISSP, CISM, CEH, or OSCP. Show more Show less

Job Title: Lead Engineer – Security Operations Department: Engineering and Operations Location: Mumbai Reporting: Manager Security Operations Job Type: Full Time Shift: Rotational Shift PRE-REQUISITES Strong technical and subject matter expertise in at least four or more of the following security specialties: Firewall: Cisco, Palo Alto, Checkpoint, Fortinet, Zscaler, Barracuda VPN - IPSEC, SSL VPN: Ivanti, F5, Cisco, GlobalProtect NAC: Cisco ISE, Aruba ClearPass Unified Thread Management (UTM) SIEM products Qradar, Microsoft Sentinel etc. Load Balancers: F5 BigIP LTM/GTM, Citrix ADC Network Security (multi-vendor) experience. Cloud Infrastructure Mgmt.: Cloud stack, OpenStack, AWS, Azure, Netskope, PaloAlto Prisma Knowledge on scripting language like Python and automation Working knowledge and hands-on experience on Linux/Unix OS is desirable. Customer service experience preferably in a Global Operations Center environment Ticketing system knowledge Ability to workdays, evenings and weekends as required; 24x7 support in rotating shifts Flexibility with the ability to manage stressful situations and adapt to rapidly changing environments and requirements Analytical thinker willing to “think outside the box” to resolve customer impacting situations on first contact; understand customer pain Ability to work with Operations and Engineering on the priority of issues to resolve the urgent customer impacting issues first Aptitude and desire to learn advanced Network Security services. Creative, flexible thinker who is willing to take initiatives and share alternative solutions with peers and management Hands-on experience on Vulnerability Scanning, Penetration Testing Tools (Qualys, Nessus, Rapid7) Exceptional documentation and communication skills Ability to thrive in a fast paced, multi-cultural, customer-oriented environment MS Office proficiency RESPONSIBILITIES Incident Resolution Ticket resolution - work on trouble tickets, support the operation of advanced Network Security Services and take escalations Queue Management - keep a watch on queue and assign tickets Service Request - working on request for changes as per client requirements Perform the minor/major changes as per defined SoC process and work instructions Be a Subject Matter Expert (SME) on a few products Create Standard Operation Procedure Attend client calls and other technical meetings Assist in creation of Root Cause analysis (RCA) Security Performance Tuning Identify areas of Service Improvement Program (SIP) for key clients and reduce incidents Review code upgrade and test implement before rolling on to production Review documentation Recognize successful intrusions and compromises through review and analysis of relevant event detail information Review and update ROE on yearly basis Other Functions Work with hardware/software vendors to resolve problems Coordinate shifts and exchange handoff between various shifts Cross-train and mentor juniors Participate in various network and security related projects Perform other duties as assigned Any additional task given to the incumbent from time-to-time based on business needs TRAINING AND CERTIFICATION REQUIRED CCNA, CCSA, Fortinet NSE-4, PCNSE, CCIE, CEH EXPERIENCE Minimum 10 years of progressive, relevant experience and proven capability to work in a complex network environment EDUCATION Bachelor in Engineering - Computers/Electronics/Communication or related field Graduate/Post Graduate in Science/Maths/IT or related streams with relevant technology experience TECHNICAL AND OTHER SKILLS Knowledge of ITIL, ISO27K, SOC 2 will be beneficial Show more Show less

Client Server Tech is looking for System Security / Engineer to join our dynamic team and embark on a rewarding career journey. Develop and implement system security strategies and solutions. Monitor and analyze security incidents and threats. Conduct incident response and investigation. Collaborate with cross-functional teams on security projects. Ensure compliance with security standards and regulations. Provide training and support on security best practices.

About Zscaler Serving thousands of enterprise customers around the world including 40% of Fortune 500 companies, Zscaler (NASDAQ: ZS) was founded in 2007 with a mission to make the cloud a safe place to do business and a more enjoyable experience for enterprise users. As the operator of the world’s largest security cloud, Zscaler accelerates digital transformation so enterprises can be more agile, efficient, resilient, and secure. The pioneering, AI-powered Zscaler Zero Trust Exchange™ platform, which is found in our SASE and SSE offerings, protects thousands of enterprise customers from cyberattacks and data loss by securely connecting users, devices, and applications in any location. Named a Best Workplace in Technology by Fortune and others, Zscaler fosters an inclusive and supportive culture that is home to some of the brightest minds in the industry. If you thrive in an environment that is fast-paced and collaborative, and you are passionate about building and innovating for the greater good, come make your next move with Zscaler. At Zscaler, our Customer Success Organization is a global, customer-focused team dedicated to delivering high-impact experiences and identifying innovative solutions. We leverage valuable data and research to provide expert, hands-on support starting from the implementation phase and beyond, ensuring customers achieve their goals and leverage our technology to its fullest potential. Together, we create a customer-centric culture that fosters success, adoption, and continuous growth. We're looking for an experienced Product Support Engineer III - DLP to join our Global Customer Support team. Reporting to the Manager, Product Support you'll be responsible for: Serving as the primary point of contact for escalated DLP issues, providing advanced troubleshooting and resolution for the escalated DLP cases Taking ownership of complex and critical cases, ensuring they are resolved effectively and efficiently Performing detailed root cause analysis to identify underlying issues and implement long-term solutions for the customers Working closely with product development, engineering, and other cross-functional teams to resolve issues and improve Zscaler DLP products and services Maintaining clear and proactive communication with customers throughout the escalation process, providing regular updates and managing expectations What We're Looking for (Minimum Qualifications) Minimum of 7+ years of experience in technical support, with at least 3 years focused on DLP/CASB solutions and escalations Expert knowledge of DLP technologies and tools (e.g., Symantec DLP, McAfee DLP, Forcepoint DLP, etc.) Experience with data loss prevention, securing SaaS and Cloud Access Security Brokers (CASB) Good understanding of Unix/Linux and Windows operating systems Strong understanding of data protection principles and practices What Will Make You Stand Out (Preferred Qualifications) Experience with scripting and automation e.g., Python, PowerShell Knowledge of regulatory requirements and compliance standards (e.g., GDPR, HIPAA, PCI-DSS) Familiarity with ticketing systems and support tools (e.g., ServiceNow, Salesforce, JIRA etc) #LI-Hybrid #LI-RR1 At Zscaler, we are committed to building a team that reflects the communities we serve and the customers we work with. We foster an inclusive environment that values all backgrounds and perspectives, emphasizing collaboration and belonging. Join us in our mission to make doing business seamless and secure. Our Benefits program is one of the most important ways we support our employees. Zscaler proudly offers comprehensive and inclusive benefits to meet the diverse needs of our employees and their families throughout their life stages, including: Various health plans Time off plans for vacation and sick time Parental leave options Retirement options Education reimbursement In-office perks, and more! By applying for this role, you adhere to applicable laws, regulations, and Zscaler policies, including those related to security and privacy standards and guidelines. Zscaler is committed to providing equal employment opportunities to all individuals. We strive to create a workplace where employees are treated with respect and have the chance to succeed. All qualified applicants will be considered for employment without regard to race, color, religion, sex (including pregnancy or related medical conditions), age, national origin, sexual orientation, gender identity or expression, genetic information, disability status, protected veteran status, or any other characteristic protected by federal, state, or local laws. See more information by clicking on the Know Your Rights: Workplace Discrimination is Illegal link. Pay Transparency Zscaler complies with all applicable federal, state, and local pay transparency rules. Zscaler is committed to providing reasonable support (called accommodations or adjustments) in our recruiting processes for candidates who are differently abled, have long term conditions, mental health conditions or sincerely held religious beliefs, or who are neurodivergent or require pregnancy-related support.