Security Technician

Role overview

Incident response and investigation

• Monitor, validate, investigate, triage, classify, prioritize, and assess incidents escalated from SOC and other sources.
• Lead technical investigations and coordinate response; execute containment, eradication, and recovery, track incidents to closure, and meet SLAs.
• Conduct host, network, and log-based forensic investigations; collect, preserve, and analyze digital evidence.
• Identify root causes and attack vectors and document findings for management and audit needs.

Threat analysis and improvement

• Analyze indicators of compromise, tactics, techniques, procedures, and threat actor activity; correlate internal and external threat intelligence.
• Recommend preventive and detective controls, conduct proactive threat hunting, develop detection use cases, and improve monitoring.
• Participate in tabletop exercises and cyber simulations; improve response procedures and knowledge resources and contribute to training.

Reporting and coordination

• Prepare incident reports, executive summaries, and root-cause analyses; conduct post-incident reviews and report incident trends and response metrics.
• Maintain incident response playbooks and standard operating procedures.
• Coordinate with infrastructure, network, application, cloud, and business teams; support crisis response and provide security recommendations and remediation guidance.

Required technical skills

• Incident response and handling; SIEM platforms including Microsoft Sentinel and Splunk; and endpoint detection and response tools including Microsoft Defender, CrowdStrike, FireEye, and Cortex XDR.
• Network security analysis, digital forensics fundamentals, threat intelligence frameworks, MITRE ATT&CK, and basic-to-intermediate malware analysis.
• Windows, Linux, and cloud security; log analysis and event correlation.
• PowerShell, Python, or Bash scripting knowledge is preferred.

Experience and certifications

• At least five years of cybersecurity experience.
• Experience leading major security incidents and deep investigations, including malware, phishing, endpoint compromise, and network-based incidents.
• Strong knowledge of threat intelligence, threat hunting, and incident coordination.
• GCIH, GCFA/GCFE, CHFI, CISSP, Security+, Microsoft Security certifications, and CEH are listed as preferred certifications.

Locations

• The posting lists Bangalore, Chennai, Noida, and Pune as job locations and describes flexibility among multiple locations in India.
• Relocation support is available; visa sponsorship is not approved.