Security Analyst - SIEM IR

Roles & Responsibilities:1.Handling alerts and incident on XDR platform2.Alert & incident triage and analysis3.Proactively investigating suspicious activities4.Log all findings, actions taken, and escalations clearly in the XDR and ITSM platform5.Execute predefined actions such as isolating blocking IPs or disabling user accounts, based on set protocols.6.Adhere to established policies, procedures, and security practices.7.Follow-up with tech team for incident closure8.Participating in daily standup and review meeting9.L1 Analyst has responsibility to closely track the incidents and support for closure.10.Escalate more complex incidents to L2 analysts for deeper analysis.11.Work & support on multiple cybersecurity tool (DLP, GRC, Cloudsec tool, DAM)12.Handle XDR alerts and followup with customer team for agent updates Required education Bachelor's Degree Preferred education Master's Degree Required technical and professional expertise Key Responsibilities:Security Monitoring & Incident Response GovernanceDefine and maintain security monitoring, threat detection, and incident response policies and procedures.Establish and mature a threat intelligence program, incorporating tactical and strategic threat feeds.Align SOC operations with evolving business risk priorities and regulatory frameworks.Platform & Toolset ManagementEvaluate, implement, and enhance SIEM platforms, ensuring optimal log ingestion, correlation, and rule effectiveness.Assess and manage deployment of EDR, XDR, SOAR, and Threat Intelligence solutions.Maintain and update incident response playbooks and automation workflows.Ensure consistent platform hygiene and technology stack effectiveness across SOC tooling.SOC Operations & Threat DetectionOversee 24x7 monitoring of security events and alerts across enterprise assets.Lead and coordinate proactive threat hunting across networks, endpoints, and cloud.Manage and support forensic investigations to identify root cause and recovery paths.Govern use case development, log source onboarding, and alert/event triage processes.Regulatory Compliance & Incident ManagementEnsure timely and accurate incident reporting in compliance with RBI, CERT-In, and other authorities.Retain logs in accordance with regulatory data retention mandates.Enforce and monitor security baselines for endpoints, in line with internal and regulatory standards.Advanced Threat Management & ReportingPlan, conduct, and report on Red Teaming and Purple Teaming exercises to test detection and response capabilities.Participate in and contribute to the Risk Operations Committee (ROC) meetings and initiatives.Review and track SOC effectiveness through KPIs, metrics, and regular reporting dashboards. Preferred technical and professional experience Required Qualifications:Bachelor’s or Master’s degree in Cybersecurity, Computer Science, or related field.2 years of experience in SOC management, incident response, or cyber threat detection roles.Hands-on expertise with SIEM (e.g., Splunk, QRadar, Sentinel), EDR/XDR tools, and SOAR platforms.Proven experience in playbook development, forensics, and threat hunting methodologies.Strong understanding of RBI/CERT-In incident reporting guidelines and log retention requirements.Familiarity with MITRE ATT&CK, threat modeling, and adversary emulation techniques.Preferred Certifications:GCIA, GCIH, GCFA, CISSP, OSCP, CEH, CHFI, or similar certifications"