Security Engineer in भारत

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer based in India. The Security Engineer will play a key role in strengthening security operations by investigating complex security incidents, improving threat detection capabilities, and developing automation to streamline incident response. You will handle Level 2 and Level 3 Security Operations Center (SOC) escalations while analyzing security data across endpoints, identities, cloud environments, networks, and applications. The role combines hands-on incident response with detection engineering, threat hunting, and security platform optimization. You will also develop automated workflows that reduce repetitive tasks and improve the efficiency of frontline security teams. Working in a collaborative technical environment, you will partner with internal stakeholders and external security providers to enhance monitoring coverage and operational resilience. This opportunity is ideal for a security professional who enjoys solving technical challenges, improving security processes, and proactively identifying emerging threats. Accountabilities - Security Operations and Incident Response: Investigate and resolve Level 2 and Level 3 security alerts, cases, and incidents using established procedures and playbooks. Gather and validate evidence, assess incident scope and impact, support containment and remediation, and contribute to recovery activities while escalating complex or high-impact situations when necessary. - Detection Engineering: Design, develop, test, deploy, and fine-tune security detections, analytical queries, correlation rules, and incident logic across SIEM, EDR, XDR, cloud, identity, email, and other security platforms. Conduct peer reviews, regression testing, MITRE ATT&CK mapping, and documentation to maintain reliable detection coverage.

- Security Automation: Develop and maintain approved automation workflows for enrichment, triage, notifications, containment, and remediation, particularly for repetitive Tier 1 scenarios that external security providers cannot fully address. - Security Platform Engineering: Support the configuration, integration, and troubleshooting of security platforms, including Microsoft Sentinel, Defender XDR, SOAR solutions, telemetry connectors, and case management systems. Investigate data quality issues and improve the reliability of detection rules and automated workflows. - Application Security Monitoring: Monitor security events across SaaS applications, PaaS environments, APIs, web applications, and database services. Develop detections for suspicious application activity, privilege changes, authentication anomalies, API abuse, unauthorized database access, and potential data exfiltration. - Threat Hunting and Analysis: Conduct targeted threat hunts and retrospective investigations using established hypotheses and analytical methods. Document findings and recommend improvements to detection logic, telemetry coverage, and security monitoring practices. - Technical Documentation and Collaboration: Maintain accurate incident records, detection specifications, automation runbooks, and operational procedures. Coordinate technical activities with internal teams and external service providers, communicate progress, and contribute to project milestones and operational objectives. - Continuous Improvement: Identify opportunities to strengthen security controls, reduce recurring escalations, improve incident handling efficiency, and enhance the overall effectiveness of security operations. Requirements - Education and Experience: A bachelor's degree with at least two years of relevant experience, a master's degree, or a PhD may satisfy the educational requirements. Equivalent knowledge or professional experience may also be considered.