Security Operations Center Analyst

We're hiring: SOC Analyst (L1/L2) | Mumbai

At Risknox, we're building out our Security Operations Centre in Mumbai, and we're looking for an analyst who wants to do more than watch alerts.

In this role you'll monitor and respond to real threats for our clients. You'll also help configure the SOC from the ground up, and work directly with our product team to improve Pulse, our SIEM and EDR platform. Your detections and fixes will ship in the product.

What you'll do

→ Triage, investigate and respond to alerts across endpoints, firewalls, servers and cloud

→ Contain incidents using EDR and escalate as per playbooks

→ Onboard clients: deploy agents, connect log sources, build parsers

→ Write and tune detection rules, dashboards and playbooks mapped to MITRE ATT&CK

→ Automate enrichment and response with Python, PowerShell or Bash

→ Shape Pulse by testing releases and turning analyst pain points into features

What we're looking for

2–3 years in a SOC, MSSP or security monitoring role

Hands-on with a SIEM (Wazuh, Elastic, Splunk, Sentinel, QRadar or similar) and an EDR/XDR tool

Has configured log sources, parsers or detection rules, not just consumed alerts

Strong grasp of Windows, Linux, Active Directory and network fundamentals

Scripting skills and clear written communication

Based in Mumbai or willing to relocate; open to rotational shifts

Good to have: Wazuh/Sigma/MISP experience; familiarity with CERT-In reporting and the DPDP Act

Why Risknox

• A real say in how a SOC and its platform get built
• A clear growth path towards L3, detection engineering or threat hunting
• exposure to clients across India and the GCC
• An award-winning team (Best Innovative Cybersecurity Solution, GISEC Global 2025)

Mumbai, on-site | Full-time | 2–3 years

• #Hiring #SOCAnalyst #CyberSecurity #MumbaiJobs #BlueTeam #SIEM #EDR #ThreatDetection #InfoSec #Risknox