Engineer

Position Overview

We are seeking a highly skilled and hands-on Senior Cyber Security Engineer to strengthen the organization's security posture across endpoints, networks, cloud environments, identities, applications, and critical infrastructure.

The role will be responsible for EDR management, SIEM/SOAR use-case development, threat intelligence, vulnerability management, cloud security, incident response, threat hunting, security monitoring, and compliance support. The candidate should be capable of handling security incidents end-to-end, improving detection capabilities, reducing false positives, mentoring junior analysts, and working closely with IT, infrastructure, cloud, application, and compliance teams.

This is a senior operational and engineering role. The candidate must be comfortable working in a dynamic security environment where critical incidents may require rotational shift support, on-call availability, weekend support, or late-night emergency response, depending on business and security requirements.

Key Responsibilities

• Lead the deployment, administration, monitoring, and optimization of EDR platforms such as CrowdStrike, SentinelOne, Microsoft Defender, Tanium, Cisco AMP, or similar tools.
• Investigate endpoint alerts involving malware, ransomware, suspicious PowerShell, lateral movement, privilege escalation, credential theft, and unauthorized access.
• Perform endpoint containment, isolation, quarantine, and remediation activities based on incident severity.
• Tune EDR policies and detections to reduce false positives and improve detection accuracy.
• Build and maintain endpoint investigation playbooks and response procedures.
• Develop, tune, and maintain SIEM correlation rules, alerts, dashboards, and reports.
• Work with platforms such as Wazuh, Splunk, Microsoft Sentinel, Securonix, QRadar, or similar SIEM tools.
• Onboard and validate log sources from endpoints, firewalls, cloud platforms, identity systems, servers, applications, and network devices.
• Create and improve detection use cases mapped to frameworks such as MITRE ATT&CK.
• Build and maintain SOAR playbooks for automation of repetitive SOC tasks, alert enrichment, phishing response, IOC blocking, and incident workflows.
• Continuously reduce false positives and improve alert quality.
• Build and manage a practical threat intelligence program using internal and external intelligence sources.
• Convert threat intelligence into actionable detections, watchlists, IOCs, SIEM rules, EDR queries, and hunting activities.
• Conduct proactive threat hunting across endpoints, network logs, identity logs, cloud logs, and email security platforms.
• Track threat actor TTPs, malware campaigns, phishing campaigns, ransomware trends, and industry-specific threats.
• Maintain threat intelligence reports and share relevant insights with internal stakeholders.
• Lead investigation and response for security incidents across endpoint, network, cloud, identity, email, and application environments.
• Act as incident lead / incident commander for high-severity incidents.
• Perform triage, containment, eradication, recovery, RCA, and post-incident review.
• Preserve evidence, collect forensic artifacts, and maintain proper incident documentation.
• Prepare incident reports including timeline, impact, root cause, corrective actions, and preventive controls.
• Coordinate with IT, infrastructure, cloud, application, legal, compliance, and management teams during major incidents.
• Maintain and periodically test incident response playbooks for malware, ransomware, phishing, account compromise, data leakage, cloud compromise, and insider threats.
• Design, implement, monitor, and improve network security controls including firewalls, IDS/IPS, WAF, VPN, proxy, DNS security, and DDoS protection.
• Investigate suspicious network activity such as port scanning, command-and-control traffic, data exfiltration, unusual outbound traffic, DNS tunneling, brute-force attempts, and lateral movement.
• Review firewall and network security rules for risk, redundancy, and compliance.
• Work with network teams to strengthen segmentation, secure remote access, and reduce attack surface.
• Support security monitoring for both north-south and east-west traffic.
• Oversee security controls across AWS, Azure, and Google Cloud Platform.
• Monitor and secure cloud workloads, IAM, storage, network security groups, cloud firewalls, logging, key management, and cloud-native security tools.
• Review and remediate cloud misconfigurations such as public storage, excessive privileges, exposed secrets, insecure security groups, and weak logging.
• Work with tools such as AWS GuardDuty, AWS Security Hub, Azure Defender for Cloud, Microsoft Entra ID, GCP Security Command Center, CSPM tools, or similar platforms.
• Investigate cloud security incidents including leaked access keys, suspicious API calls, risky sign-ins, privilege abuse, and exposed assets.
• Support secure cloud deployment practices and coordinate with DevOps / cloud engineering teams.
• Lead vulnerability management lifecycle including scanning, validation, prioritization, remediation tracking, exception handling, and reporting.
• Work with tools such as Qualys, Nessus, Rapid7, Tenable, or similar platforms.
• Prioritize vulnerabilities based on CVSS, asset criticality, exploitability, internet exposure, business impact, and regulatory requirements.
• Track remediation SLAs and coordinate with infrastructure, application, and business teams for closure.
• Support patch governance and compensating control recommendations.
• Prepare vulnerability dashboards and aging reports for management review.
• Monitor and strengthen identity security controls including MFA, privileged access, conditional access, risky login detection, and account compromise monitoring.
• Investigate impossible travel, brute-force login attempts, privilege escalation, suspicious account creation, and abnormal access patterns.
• Support periodic access reviews and privileged access governance.
• Work with IAM, PAM, Active Directory, Microsoft Entra ID / Azure AD, and related identity systems.
• Monitor and manage email security platforms such as Proofpoint, Cofense, Microsoft Defender for Office 365, Mimecast, or similar tools.
• Investigate phishing, spear phishing, BEC, malware attachments, credential harvesting, spoofing, and suspicious email campaigns.
• Analyze email headers, URLs, attachments, sender reputation, SPF, DKIM, and DMARC alignment.
• Coordinate takedown/blocking of malicious domains, URLs, senders, and attachments.
• Conduct enterprise-wide search and cleanup for malicious emails.

Skills

• Decision Making
• Critical Thinking
• Analytical Thinking
• Data Analysis & Interpretation
• Leadership & Teamwork
• Process Improvement

Job Details

• Designation: Senior Cyber Security Engineer
• Location: Mumbai / Nashik
• Years of Experience: 5-10 years
• Department: Information Security
• Job Type: Full-time
• Work Model: Office / Hybrid as per company policy

Qualifications

• B.E. / B.Tech

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.