Cyber Security Analyst

Role & responsibilities

1. Firewall and network security

• Own enterprise NGFW infrastructure (Fortinet, Palo Alto, Check Point or equivalent), including HA clusters.
• Design, review and implement firewall policies, NAT/VIP, IPsec and SSL VPN, and SD-WAN.
• Run periodic rule-base reviews to remove unused, shadowed, risky and overly permissive rules.
• Maintain firmware, security patches and configuration backups under change control.
• Enforce segmentation across Internet, DMZ, data centre, branches and cloud.

2. Web Application Firewall (WAF)

• Deploy, tune and monitor WAF policies for all internet-facing applications.
• Defend against OWASP Top 10 attacks (SQL injection, XSS), bots, DDoS and application-layer abuse.
• Onboard new applications, manage TLS certificates and reduce false positives with application teams.
• Periodically review the external attack surface for exposed applications and services.

3. SOC (Security Operations Centre)

• Oversee 24x7 security monitoring with the in-house SOC or managed service provider.
• Define monitoring requirements, escalation paths, SLAs and playbooks.
• Review critical alerts and ensure thorough investigation and closure.
• Track and report security KPIs and KRIs such as MTTD and MTTR.

4. SIEM and security monitoring

• Administer SIEM platforms (Microsoft Sentinel, Splunk, QRadar, FortiSIEM or equivalent).
• Onboard log sources: firewalls, WAF, servers, endpoints, Active Directory, network devices, cloud and applications.
• Build and tune correlation rules and use cases mapped to MITRE ATT&CK.
• Maintain log retention, dashboards and management reports.

5. NOC and network operations

• Coordinate with the NOC on ISP/WAN links, VPN tunnels, device availability, latency and bandwidth.
• Establish a clear NOC to SOC to Cyber Security escalation path.
• Separate infrastructure incidents from security incidents and fix recurring root causes.

6. Vulnerability management

• Run vulnerability management using Tenable, Qualys or equivalent.
• Prioritize critical and high findings and drive remediation with server, endpoint and application teams.
• Track remediation SLAs, security exceptions and overall security posture.

7. Incident response

• Lead responses to ransomware, malware, phishing, account compromise, data leakage, web and network attacks.
• Maintain incident response plans and playbooks; coordinate forensics where needed.
• Run post-incident reviews and track corrective actions to closure.

8. Governance and compliance

• Maintain security policies, standards, SOPs and architecture documentation.
• Support ISO 27001, CERT-In, DPDP Act and other regulatory requirements.
• Maintain the security risk register and support internal and external audits.
• Evaluate security tools and manage vendors and implementation partners.

Preferred candidate profile

1. Firewall (Fortinet, Forti Manager Mandatory)

2. EDR and XDR
3. Proxy (Netskope)
4. WAF
5. IAM (Good to have)