About the Role
Reward360 Global Services (R360) operates a banking loyalty and rewards platform integrated with major Indian and international banks, including HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. As R360 stands up a dedicated inhouse Security Operations Centre (SOC), the Permanent SOC Analyst will be a frontline defender for production environments serving these regulated banking clients, delivering 24x7 detection, triage, and incident response across our EDR/XDR stack, while maintaining strict compliance with PCI DSS v4.0.1, the RBI Cyber Security Framework, and the DPDP Act 2023.
Key Responsibilities
1. 24x7 Detection & Monitoring
- Monitor CrowdStrike Falcon, SentinelOne , PIM,PAM, and DAM Singularity consoles for endpoint, cloud workload, and identity-based threat detections across production and UAT estates.
- Maintain client-segmented visibility and SLA adherence for HDFC, ICICI, and Kotak-linked environments in line with each bank's InfoSec SLA and contractual security addenda.
2. Triage, Investigation & Escalation
- Perform L1/L2 alert triage and investigation, mapping detections to MITRE ATT&CK tactics/techniques.
- Tune detection rules (custom IOAs in CrowdStrike, Deep Visibility / STAR rules in SentinelOne) to reduce false positives without eroding coverage.
- Escalate confirmed incidents per the SOC escalation matrix, with clear severity classification and business-impact framing.
3. Incident Response
- Execute containment, eradication, and recovery actions using EDR host-isolation and remediation capability.
- Preserve chain-of-custody and forensic integrity for evidence supporting internal investigations and, where required, regulator/bank-facing reporting. Support incident timelines aligned to RBI's cyber-incident reporting mandate and CERT-In reporting obligations.
4. Threat Hunting & Detection Engineering
- Run hypothesis-driven threat hunts across endpoint telemetry, prioritizing BFSI-targeted TTPs (banking trojans, ATM/POS malware families, phishing-to-RAT chains, credential-harvesting campaigns).
- Correlate EDR telemetry with SIEM, AWS WAF, CloudTrail, and application logs to reconstruct crossenvironment attack chains.
5. Compliance, Audit & Change Support
- Provide InfoSec sign-off inputs for change requests (PCCB) impacting SOC-monitored assets, where applicable.
- Support PCI DSS QSA assessments, ISO 27001 audits, and bank-specific annual vendor security reviews with SOC tooling evidence (alert logs, detection coverage reports, response-time metrics).
6. Documentation & Mentorship
- Maintain shift handover notes, SOC playbooks, and runbooks; contribute to continuous improvement of detection use cases.
- Mentor SOC interns on triage methodology, tool usage, and escalation discipline.
Required Qualifications
- Bachelor's degree in computer science, IT, or a related field (or equivalent practical experience).
- 2–3 years of hands-on SOC / blue-team experience, ideally within BFSI, fintech, or another regulated environment.
- Working expertise with at least one EDR/XDR/ platform, incident responder; CrowdStrike Falcon and/or SentinelOne Singularity strongly preferred.
- Solid grounding in the MITRE ATT&CK framework, cyber kill chain analysis, and common BFSI threat-actor TTPs.
- Familiarity with SIEM platforms (Splunk / QRadar / Microsoft Sentinel / ELK) for cross-source log correlation.
- Working knowledge of PCI DSS v4.0.1 (particularly Requirements 10, 11, and 12), the RBI Cyber Security Framework, and DPDP Act 2023 fundamentals.
- Comfort with Windows and Linux internals, core network protocols (TCP/IP, DNS, HTTP/S), and common attack vectors.
- Scripting/automation ability (Python or PowerShell) for detection engineering or SOAR playbook development is a strong plus.
- Familiarity with building internal SOC tools and Agentic automation
Preferred Certifications
- CompTIA Security+ / CySA+
CrowdStrike Certified Falcon Administrator (CCFA) or Responder (CCFR) CEH (Certified Ethical Hacker)
CSA OSDA
Soft Skills
- Willingness and ability to work rotational shifts, including nights and weekends, as part of 24x7 SOC coverage.
- Strong written communication for incident reports, shift handovers, and periodic client-facing summaries.
- Composure under pressure, able to prioritise correctly during multi-alert or major-incident scenarios.
