ICC - Security Operations Analyst - Cyber Defense

Accountabilities: Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security technologies, and cloud platforms. Analyze logs and security events from Windows and Linux systems, databases, applications, web servers, firewalls, and network intrusion detection systems. Investigate suspicious activity, determine potential root causes, and assess the severity and impact of security incidents. Support incident response, remediation, recovery, and containment activities in coordination with relevant cybersecurity teams. Determine appropriate escalation paths and collaborate with Incident Response specialists when threats require deeper investigation. Identify opportunities to improve detection quality, optimize security monitoring, reduce false positives, and tune whitelists. Prepare technical reports, investigation summaries, and security findings for relevant stakeholders. Maintain SOC procedures, technical documentation, playbooks, and knowledge-base content. Contribute to operational improvements, process optimization, and cybersecurity quality initiatives. Requirements 5+ years of relevant IT and/or cybersecurity experience, with hands-on experience in security operations. Proven experience with security alert triage, threat investigation, and incident response processes. Practical experience working with SIEM and EDR platforms in enterprise environments. Strong log analysis capabilities across Windows/Linux systems and broader enterprise infrastructure. Deep knowledge of Microsoft Security technologies. Experience with at least one major cloud environment, such as Azure, AWS, or GCP. Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, or ELK. Experience with EDR solutions such as Microsoft Defender for Endpoint or CrowdStrike. Knowledge of email security, network monitoring, threat detection, and incident response. Strong knowledge of Linux, macOS, and Windows operating systems. Fluent English with strong written and verbal communication skills. Ability to work effectively within global, distributed cybersecurity teams and coordinate investigations across different functions. Nice to Have Tier 1 or Tier 2 incident response experience. Experience with AWS security monitoring across IaaS, PaaS, or SaaS environments. Scripting experience with Python, PowerShell, Bash, Ruby, or similar languages. Relevant certifications such as SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE. Previous experience working in a global SOC or distributed cybersecurity operation. Benefits Full-time remote work from India. Six-month contract with potential for extension. Opportunity to work within a global 24/7 Security Operations Centre. Exposure to a broad cybersecurity technology stack spanning SIEM, EDR, cloud, network, endpoint, and enterprise security. Collaboration with cybersecurity specialists across multiple regions and technical disciplines. Hands-on experience with real-world threat detection, investigation, incident response, and remediation. Opportunity to contribute to security monitoring optimization and operational improvement initiatives. Globally distributed and remote-first working environment. Inclusive and transparent recruitment environment.