SOC Infrastructure Lead

Job Description

We are looking for an experienced SOC Infrastructure Lead with strong expertise in Microsoft Security solutions, Security Operations Center (SOC) engineering, SIEM/SOAR platforms, threat detection, and incident response. The ideal candidate will have hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender for Endpoint, and other Microsoft security technologies.

The candidate will be responsible for managing security infrastructure, developing threat detection strategies, improving security monitoring capabilities, and implementing automated security workflows to strengthen the organization's overall security posture.

Key Responsibilities

• Manage and optimize Microsoft Sentinel and Microsoft Defender security solutions.
• Configure, monitor, and maintain Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud.
• Develop and maintain SIEM use cases, detection rules, analytics rules, and security monitoring dashboards.
• Perform threat hunting, security investigations, and detection engineering using KQL (Kusto Query Language).
• Manage and improve SIEM/SOAR platforms, security automation, and incident response workflows.
• Develop and implement automation playbooks using Microsoft Sentinel and Azure Logic Apps.
• Investigate security alerts, analyze incidents, and coordinate incident response activities.
• Apply the MITRE ATT&CK Framework and Cyber Kill Chain methodology to threat detection and investigation.
• Implement and manage Microsoft Entra ID security, Conditional Access, Identity Protection, and Privileged Identity Management (PIM).
• Support Azure Security, Microsoft 365 Security, cloud security architecture, and security monitoring initiatives.
• Monitor network security events and troubleshoot issues involving TCP/IP, DNS, HTTP/HTTPS, VPNs, and firewalls.
• Identify security gaps, recommend improvements, and implement security best practices.
• Collaborate with security teams and stakeholders to enhance SOC operations and incident management processes.
• Support US business hours and participate in on-call rotations as required.

Required Skills

• Microsoft Sentinel
• Microsoft Defender XDR
• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Defender for Office 365
• Microsoft Defender for Cloud
• SIEM / SOAR
• KQL (Kusto Query Language)
• SOC Operations and Security Monitoring
• Threat Hunting and Detection Engineering
• Incident Response
• Azure Security and Microsoft 365 Security
• Microsoft Entra ID
• Conditional Access and Identity Protection
• Privileged Identity Management (PIM)
• Azure Logic Apps and Security Automation
• MITRE ATT&CK Framework
• Network Security Fundamentals

Mandatory Requirements

• Minimum 6+ years of experience in Cybersecurity, SOC Engineering, Security Operations, or Security Infrastructure.
• Strong hands-on experience with Microsoft Sentinel and Microsoft Defender security solutions.
• Experience in SIEM/SOAR implementation, management, and security automation.
• Strong knowledge of KQL for threat hunting, investigations, and detection engineering.
• Good understanding of Azure Security, Microsoft 365 Security, and identity security.
• Excellent analytical, troubleshooting, and problem-solving skills.
• Strong verbal and written communication skills.
• Willingness to work from the Chennai office five days a week.
• Willingness to work the US shift from 5:30 PM to 2:30 AM IST.

Preferred Candidate Profile

Candidates with hands-on experience in Microsoft security technologies, enterprise SOC infrastructure, advanced threat detection, incident response, and security automation will be preferred.

Interested candidates can apply with their updated resumes.