SOC Analyst

About the Role

Reward360 Global Services (R360) operates a banking loyalty and rewards platform integrated with major Indian and international banks, including HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. As R360 stands up a dedicated inhouse Security Operations Centre (SOC), the Permanent SOC Analyst will be a frontline defender for production environments serving these regulated banking clients, delivering 24x7 detection, triage, and incident response across our EDR/XDR stack, while maintaining strict compliance with PCI DSS v4.0.1, the RBI Cyber Security Framework, and the DPDP Act 2023.

Key Responsibilities

1. 24x7 Detection Monitoring

Monitor CrowdStrike Falcon, SentinelOne , PIM,PAM, and DAM Singularity consoles for endpoint, cloud workload, and identity-based threat detections across production and UAT estates.

Maintain client-segmented visibility and SLA adherence for HDFC, ICICI, and Kotak-linked environments in line with each banks InfoSec SLA and contractual security addenda.

2. Triage, Investigation Escalation

Perform L1/L2 alert triage and investigation, mapping detections to MITRE ATTCK tactics/techniques.

Tune detection rules (custom IOAs in CrowdStrike, Deep Visibility / STAR rules in SentinelOne) to reduce false positives without eroding coverage.

Escalate confirmed incidents per the SOC escalation matrix, with clear severity classification and business-impact framing.

3. Incident Response

Execute containment, eradication, and recovery actions using EDR host-isolation and remediation capability.

Preserve chain-of-custody and forensic integrity for evidence supporting internal investigations and, where required, regulator/bank-facing reporting. Support incident timelines aligned to RBIs cyber-incident reporting mandate and CERT-In reporting obligations.

4. Threat Hunting Detection Engineering

Run hypothesis-driven threat hunts across endpoint telemetry, prioritizing BFSI-targeted TTPs (banking trojans, ATM/POS malware families, phishing-to-RAT chains, credential-harvesting campaigns).

Correlate EDR telemetry with SIEM, AWS WAF, CloudTrail, and application logs to reconstruct crossenvironment attack chains.

5. Compliance, Audit Change Support

Provide InfoSec sign-off inputs for change requests (PCCB) impacting SOC-monitored assets, where applicable.

Support PCI DSS QSA assessments, ISO 27001 audits, and bank-specific annual vendor security reviews with SOC tooling evidence (alert logs, detection coverage reports, response-time metrics).

6. Documentation Mentorship

Maintain shift handover notes, SOC playbooks, and runbooks; contribute to continuous improvement of detection use cases.

Mentor SOC interns on triage methodology, tool usage, and escalation discipline.

Required Qualifications

Bachelors degree in computer science, IT, or a related field (or equivalent practical experience).

2-3 years of hands-on SOC / blue-team experience, ideally within BFSI, fintech, or another regulated environment.

Working expertise with at least one EDR/XDR/ platform, incident responder; CrowdStrike Falcon and/or SentinelOne Singularity strongly preferred.

Solid grounding in the MITRE ATTCK framework, cyber kill chain analysis, and common BFSI threat-actor TTPs.

Familiarity with SIEM platforms (Splunk / QRadar / Microsoft Sentinel / ELK) for cross-source log correlation.

Working knowledge of PCI DSS v4.0.1 (particularly Requirements 10, 11, and 12), the RBI Cyber Security Framework, and DPDP Act 2023 fundamentals.

Comfort with Windows and Linux internals, core network protocols (TCP/IP, DNS, HTTP/S), and common attack vectors.

Scripting/automation ability (Python or PowerShell) for detection engineering or SOAR playbook development is a strong plus.

Familiarity with building internal SOC tools and Agentic automation

Preferred Certifications

CompTIA Security+ / CySA+

CrowdStrike Certified Falcon Administrator (CCFA) or Responder (CCFR) CEH (Certified Ethical Hacker)

CSA OSDA

Soft Skills

Willingness and ability to work rotational shifts, including nights and weekends, as part of 24x7 SOC coverage.

Strong written communication for incident reports, shift handovers, and periodic client-facing summaries.

Composure under pressure, able to prioritise correctly during multi-alert or major-incident scenarios.