Walk-in || Deloitte_Walk-In Drive_Cyber_Gurgaon_ General SOC (L2)

Key responsibilities

• Monitor, triage, investigate, and resolve security alerts using evidence from SIEM, EDR/XDR, identity, network, email, cloud, and application sources.
• Create and tune correlation rules, behavioral analytics, searches, dashboards, reports, watchlists, and thresholds across supported SIEM platforms.
• Use platform query languages such as SPL, KQL, YARA-L, and XQL to investigate suspicious activity and establish incident scope and timeline.
• Perform log-source onboarding validation, parser and field-mapping checks, use-case testing, and data-quality troubleshooting with engineering teams.
• Lead L2 investigations, escalate confirmed incidents with clear evidence and recommendations, and support containment, eradication, and recovery.
• Map detections to MITRE ATT&CK, identify coverage gaps, and contribute new use cases based on threats, incidents, vulnerabilities, and business risk.
• Execute threat hunts, false-positive reviews, alert-quality reviews, backlog reduction, and continuous use-case optimization.
• Create and maintain runbooks, investigation guides, case records, handover notes, knowledge articles, and customer-facing reports.
• Support shift operations, major incidents, audits, service reviews, and KPI tracking for MTTD, MTTR, SLA, quality, and alert disposition.

Essential qualifications and expertise

• 5-8 years of cybersecurity experience, including at least 3 years in SOC operations, incident response, SIEM administration, or detection engineering.
• Hands-on expertise in at least three leading enterprise SIEM technologies, with preferred platforms including Google Security Operations, Palo Alto Networks Cortex XSIAM, Microsoft Sentinel, and Splunk Enterprise Security.
• Proficiency in at least two relevant query languages, such as YARA-L, XQL, KQL, or SPL, and the ability to interpret raw security telemetry.
• Strong understanding of incident response, MITRE ATT&CK, Windows/Linux, identity, networking, endpoint, cloud, and common attacker techniques.

Preferred qualifications

• Security+, CySA+, GCIH, GCIA, SC-200, OEM certification, or equivalent.
• Experience with SOAR, Python/API automation, cloud security, threat intelligence, vulnerability management, and managed SOC delivery.