Powering access to brighter lives in Africa, Asia, and beyond.
Security Operations Center Analyst
Location
India
Posted
4 days ago
Salary
0
Seniority
Senior
Job Description
Security Operations Center Analyst
Sun King
• Monitor, triage, and investigate security events across AWS, endpoint security platforms, Google Workspace, identity providers, and other enterprise security solutions. • Review and analyze threat intelligence feeds, Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) to validate detections, improve monitoring, and enhance detection use cases. • Enrich security investigations using OSINT, domain intelligence, and threat intelligence sources to identify malicious activity and support attribution. • Correlate telemetry from endpoints, networks, cloud environments, identity platforms, SIEM, EDR, and other security tools to build comprehensive investigation context and identify threats. • Design, develop, maintain, and optimize SIEM/SOAR detection rules, playbooks, dashboards, and alerts. Onboard and validate new log sources to ensure complete and normalized visibility. • Perform proactive threat hunting and endpoint/cloud forensics to identify previously undetected threats, determine scope and root cause, and provide evidence to support incident response. • Lead end-to-end incident response activities, including triage, investigation, containment, eradication, recovery, root cause analysis (RCA), reporting, and maintenance of incident response playbooks and standard operating procedures. • Monitor and recommend security improvements across AWS services, including CloudTrail, GuardDuty, Security Hub, IAM, VPC Flow Logs, CloudWatch, and AWS Config, to detect suspicious activity and misconfigurations. • Investigate identity-related threats using authentication logs, privileged account activity, and collaboration platform audit logs. • Administer, integrate, and perform health checks for SIEM, SOAR, EDR, and related security technologies to ensure reliable security operations. • Develop and maintain security automation, internal tools, and integrations using Python, PowerShell, Bash, APIs, and webhooks to improve investigation and response efficiency. • Maintain and optimize threat intelligence repositories, IOC watchlists, enrichment workflows, and dashboards, translating intelligence into improved detections and alert tuning. • Support vulnerability management by reviewing findings, validating remediation efforts, and contributing to risk-based prioritization. • Prepare clear and concise incident reports, root cause analysis documents, threat intelligence summaries, executive updates, and SOC performance metrics. • Collaborate with Infrastructure, Cloud, IT, and Engineering teams to implement security controls, strengthen detections, and coordinate incident response activities. • Evaluate and implement AI-assisted security workflows to improve threat detection, alert triage, investigations, and incident response. • Continuously assess and enhance SOC architecture, monitoring strategy, KPIs/KRIs, automation, and overall SOC maturity in alignment with industry best practices.
Job Requirements
- 3–6 years of experience in Security Operations, including threat detection, incident response, threat hunting, and digital forensics across cloud and enterprise environments.
- Demonstrated experience managing high-severity security incidents and improving SOC capabilities through process improvements, automation, and measurable operational metrics.
- Experience building AI- or LLM-assisted SOC workflows for alert triage, investigation summarization, and multi-source threat correlation while validating AI-generated outputs for accuracy. (Preferred)
- Familiarity with AI security frameworks and threat models such as MITRE ATLAS and the OWASP Top 10 for LLM Applications. (Preferred)
- Proficiency in Python, PowerShell, Bash, and REST APIs to develop automation, detection content, playbooks, and security workflows.
- Experience integrating security technologies, managing log pipelines, and implementing automation that balances operational efficiency with appropriate human oversight.
- Strong interest in emerging threats, attacker techniques, and defensive strategies, with a commitment to continuous learning and professional development.
- Demonstrated ownership, problem-solving ability, and commitment to protecting organizational assets while enabling secure business operations.
- Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related discipline, or equivalent practical experience.
- Professional security certifications such as OSCE, CRTP, SC-200, or equivalent are preferred.
- Strong written and verbal communication skills, with the ability to collaborate effectively across technical and non-technical teams.
Benefits
- Professional growth in a dynamic, rapidly expanding, high-social-impact industry
- An open-minded, collaborative culture made up of enthusiastic colleagues who are driven by the challenge of innovation towards profound impact on people and the planet.
- A truly multicultural experience: you will have the chance to work with and learn from people from different geographies, nationalities, and backgrounds.
- Structured, tailored learning and development programs that help you become a better leader, manager, and professional through the Sun King Center for Leadership.
Related Guides
Related Categories
Related Job Pages
More Security Operations Jobs
Information Security Analyst
It4us Cyber SecurityGarantindo a Cyber Segurança de nossos amigos e clientes !
• Implement and configure Google SecOps environments. • Onboard log sources using BindPlane, Syslog, APIs and other integration methods. • Configure and manage collectors and log ingestion pipelines. • Integrate different technologies. • Configure parsers, normalization (UDM), enrichment and validation of collected events. • Develop and tune detection rules and use cases. • Execute acceptance and validation testing of the platform. • Produce technical implementation documentation and operational procedures. • Collaborate with client technical teams throughout all phases of the project. • Support troubleshooting, adjustments and post-deployment optimizations.
Security Operations Analyst
CommvaultCommvault is the gold standard in cyber resilience, helping customers prevail against ransomware at the lowest TCO.
• Investigate security alerts using tools such as CrowdStrike Falcon Suite, Microsoft Sentinel, endpoint telemetry, identity logs, network data, and cloud security sources. • Perform alert triage and analysis to determine the scope, severity, and potential impact of security events. • Support incident response activities, including investigation, containment, remediation, recovery, and post-incident documentation. • Participate in rotational on-call escalation coverage for higher-priority security events outside normal business hours, as needed. • Write clear incident reports, investigation summaries, timelines, findings, and recommended improvements. • Support selected SOC projects focused on improving detection quality, workflows, playbooks, reporting, automation, and response readiness. • Participate in regular security operations reviews and collaborate with cross-functional teams, including Security Engineering, Threat and Vulnerability Management, Networking, Infrastructure, Identity, and IT Operations.
Cybersecurity Operations Analyst II
HARVEST VALUATIONSHarvest Valuations LLC is an equal opportunity employer. In accordance with anti-discrimination law, it is the purpose of this policy to effectuate these principles and mandates. Harvest Valuations LLC prohibits discrimination and harassment of any type and affords equal employment opportunities to employees and applicants without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law. Harvest Valuations LLC conforms to the spirit as well as to the letter of all applicable laws and regulations.
Role Description Harvest is seeking a Cybersecurity Operations Analyst II to join our team on a full-time basis. The Cybersecurity Operations Analyst is responsible for protecting the organization's information systems through the administration of security technologies, continuous monitoring, vulnerability management, incident response, and operational security initiatives. This position works closely with IT teams to maintain a secure environment while supporting the organization's compliance objectives. - Monitor, investigate, and respond to security events, alerts, and incidents across endpoint, identity, cloud, and network security platforms. - Administer and maintain cybersecurity technologies including endpoint protection, vulnerability management, security logging, email security, and identity security solutions. - Perform vulnerability assessments, coordinate remediation efforts with IT teams, and validate corrective actions to reduce organizational risk. - Support security operations by maintaining security documentation, developing operational procedures, and assisting with security audits, compliance initiatives, and customer security assessments. - Participate in the implementation, configuration, and continuous improvement of security controls, technologies, and operational processes. - Assist with user access reviews, security awareness initiatives, phishing campaigns, and other activities that promote a strong security posture. - Collaborate with cross-functional teams to investigate security concerns, support infrastructure projects, and ensure security best practices are incorporated into daily operations. Qualifications - 3+ years of experience in cybersecurity, systems administration, or information technology with a security focus. - Experience administering endpoint protection, vulnerability management, security logging/SIEM, and Microsoft Windows environments. - Working knowledge of Active Directory, Microsoft 365/Azure, networking fundamentals, and incident response processes. - Strong analytical, troubleshooting, documentation, and communication skills. - Ability to manage multiple priorities while working independently and collaboratively in a fast-paced environment. Preferred Qualifications - Experience with CrowdStrike, Microsoft 365 Security, Azure, Log360 or similar SIEM platforms, and vulnerability management solutions. - Familiarity with SOC 2, CIS Controls, or the NIST Cybersecurity Framework. - Industry certifications such as Security+, CySA+, SSCP, or equivalent. Physical Requirements - Prolonged periods of sitting at a desk and working on a computer. - Ability to operate computer equipment. - Ability to occasionally walk, stand, bend, or reach when accessing equipment, cabling, or hardware components. - Ability to communicate effectively in person and via electronic means. Remote Work Environment Requirements - Dedicated, quiet workspace free from distractions to maintain focus and accuracy. - Reliable high-speed internet connection to support secure document processing and collaboration. - Ability to meet deadlines in a remote setting while maintaining attention to detail. - Strong self-discipline and time management skills to work independently and efficiently. - Comfortable using remote communication tools (e.g. email, Microsoft Teams, Zoom) for team collaboration. Benefits - This is a full-time position with competitive compensation and good work/life balance. - Health insurance. - Paid Time Off. - Disability insurance. - Paid holidays. - 401k with employer contribution. - Remote work environment. - Generally, promotion within firm.
• Responsible for the tools, configuration, administration and related processes around Security Information and Event Management. • Responsible for Web application firewall and related prevention, detection and mitigation of DDoS attack. • Performs regular firewall audits in line with our procedures and provides the appropriate documentation. • Responsible for tooling, processes and follow up actions related to vulnerability scanning. • Handles the identification, planning and implementation of cloud hardening needs. • Performs security incident analysis, response and remediation. • Participates in design and implementation of security automation workflows. • Maintain the technical documentation of processes and procedures. • Perform scripting duties in Bash and Python. • Maintain an advanced level of knowledge of JAMF Cloud Services and related products.
