Description review
Sr IT Cyber Defense Analyst
Harris · India · back to the listing
HR standards
68/100
needs work
Title ↔ description
88/100
strong
Reads as
Security Engineer
98% confident
What this role officially is
ICT security administrator — ESCO, the EU occupation classification
ICT security administrators plan and carry out security measures to protect information and data from unauthorised access, deliberate attack, theft and corruption.
Also known as: network security administrator, system security administrator, ICT security administrators, IT security administrator
How others title the same work
Large employers
- Security Risk Management Specialist Canonical Ltd.
- Security Software Engineer Canonical Ltd.
- Senior Security Operations Engineer Canonical Ltd.
- Staff Security Operations Engineer Canonical Ltd.
- Ubuntu Security Engineer Canonical Ltd.
Startups
- Security Engineer (Bangalore, India) AiPrise
- Security & Trust Engineer Alex
- Elucid | Senior Security Engineer | Boston, MA | ONSITE (hybrid) | $130k–$170k Elucid
- Factory | Security Engineer | ONSITE, San Francisco, CA | Full-Time Factory
- Factory | Security Engineer | Onsite in San Francisco | Full-time Factory
What the listing never says
- 22 bullet points. Long requirement lists deter qualified candidates, who read them as hard gates. Scope clarity
- No pay range published. Candidates cannot tell whether applying is worth their time. Pay transparency
The listing, marked up
Nothing in the wording of this listing tripped a check. The scores above still judge how complete and coherent it is.
Senior IT Cyber Defense Analyst (Shift Lead)
AI-Enabled Security Operations | 24/7 SOC
Location: Remote – Pune/Baroda, India
Department: IT Cybersecurity – Security Operations Center (SOC)
Reports To: SOC Manager
Work Schedule: 24/7 rotational shifts
About the Role
We are seeking an experienced Senior IT Cyber Defense Analyst (Shift Lead) to lead day-to-day SOC operations, oversee security investigations, coordinate incident response, and mentor SOC analysts. The ideal candidate will bring strong SIEM/EDR expertise, advanced threat investigation skills, and hands-on experience using AI/LLM tools and automation to improve SOC efficiency and detection capabilities.
Key Responsibilities
• Lead SOC shift operations, prioritize alerts, manage escalations, and ensure timely handovers and SLA adherence.
• Investigate complex incidents involving phishing, malware, ransomware, compromised accounts, endpoint threats, and suspicious network activity.
• Conduct threat hunting, correlate security telemetry, and map attacker behavior to the MITRE ATT&CK framework.
• Develop, optimize, and troubleshoot SIEM queries, analytics rules, and detection use cases using Microsoft Sentinel and KQL.
• Use approved AI/LLM tools for alert triage, investigation assistance, threat intelligence enrichment, KQL development, incident reporting, and workflow automation; independently validate AI-generated outputs.
• Automate repetitive SOC tasks using Python, PowerShell, APIs, or SOAR capabilities.
• Mentor analysts, improve investigation quality, reduce false positives, and maintain accurate incident documentation and audit-ready evidence.
• Coordinate with Incident Response, IT, Endpoint, Network, and Cloud teams to support containment, remediation, and recovery.
Required Skills and Qualifications
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent practical experience.
• 5+ years of experience in SOC, cyber defense, or incident response, including shift leadership, incident coordination, or analyst mentoring.
• Strong hands-on experience with SIEM, EDR/XDR, incident investigation, and threat detection.
• Proficiency in Microsoft Sentinel and KQL; experience with Microsoft Defender, CrowdStrike, or similar security platforms.
• Strong understanding of networking, Windows/Linux, identity security, email threats, and MITRE ATT&CK.
• Mandatory practical AI/LLM proficiency, including prompt engineering, AI-assisted investigations, validation of AI-generated queries/scripts, and awareness of hallucinations, prompt injection, and data privacy risks.
• Scripting or automation experience using Python, PowerShell, APIs, or SOAR tools.
• Strong analytical, communication, decision-making, and team leadership skills; willingness to work in a 24/7 rotational shift environment.
Preferred Qualifications
• Certifications such as Microsoft SC-200, CompTIA CySA+, GCIH, or relevant SIEM/EDR vendor certifications.
• Experience in proactive threat hunting, detection engineering, cloud security, and SOC process improvement.
What Success Looks Like
• Effective shift leadership and timely, high-quality incident handling.
• Improved detection coverage, investigation efficiency, and reduced false positives.
• Practical adoption of AI and automation to reduce repetitive work while maintaining security, accuracy, and human oversight.
• Strong analyst development, documentation, and operational consistency.
Originally posted on Himalayas
AI-Enabled Security Operations | 24/7 SOC
Location: Remote – Pune/Baroda, India
Department: IT Cybersecurity – Security Operations Center (SOC)
Reports To: SOC Manager
Work Schedule: 24/7 rotational shifts
About the Role
We are seeking an experienced Senior IT Cyber Defense Analyst (Shift Lead) to lead day-to-day SOC operations, oversee security investigations, coordinate incident response, and mentor SOC analysts. The ideal candidate will bring strong SIEM/EDR expertise, advanced threat investigation skills, and hands-on experience using AI/LLM tools and automation to improve SOC efficiency and detection capabilities.
Key Responsibilities
• Lead SOC shift operations, prioritize alerts, manage escalations, and ensure timely handovers and SLA adherence.
• Investigate complex incidents involving phishing, malware, ransomware, compromised accounts, endpoint threats, and suspicious network activity.
• Conduct threat hunting, correlate security telemetry, and map attacker behavior to the MITRE ATT&CK framework.
• Develop, optimize, and troubleshoot SIEM queries, analytics rules, and detection use cases using Microsoft Sentinel and KQL.
• Use approved AI/LLM tools for alert triage, investigation assistance, threat intelligence enrichment, KQL development, incident reporting, and workflow automation; independently validate AI-generated outputs.
• Automate repetitive SOC tasks using Python, PowerShell, APIs, or SOAR capabilities.
• Mentor analysts, improve investigation quality, reduce false positives, and maintain accurate incident documentation and audit-ready evidence.
• Coordinate with Incident Response, IT, Endpoint, Network, and Cloud teams to support containment, remediation, and recovery.
Required Skills and Qualifications
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent practical experience.
• 5+ years of experience in SOC, cyber defense, or incident response, including shift leadership, incident coordination, or analyst mentoring.
• Strong hands-on experience with SIEM, EDR/XDR, incident investigation, and threat detection.
• Proficiency in Microsoft Sentinel and KQL; experience with Microsoft Defender, CrowdStrike, or similar security platforms.
• Strong understanding of networking, Windows/Linux, identity security, email threats, and MITRE ATT&CK.
• Mandatory practical AI/LLM proficiency, including prompt engineering, AI-assisted investigations, validation of AI-generated queries/scripts, and awareness of hallucinations, prompt injection, and data privacy risks.
• Scripting or automation experience using Python, PowerShell, APIs, or SOAR tools.
• Strong analytical, communication, decision-making, and team leadership skills; willingness to work in a 24/7 rotational shift environment.
Preferred Qualifications
• Certifications such as Microsoft SC-200, CompTIA CySA+, GCIH, or relevant SIEM/EDR vendor certifications.
• Experience in proactive threat hunting, detection engineering, cloud security, and SOC process improvement.
What Success Looks Like
• Effective shift leadership and timely, high-quality incident handling.
• Improved detection coverage, investigation efficiency, and reduced false positives.
• Practical adoption of AI and automation to reduce repetitive work while maintaining security, accuracy, and human oversight.
• Strong analyst development, documentation, and operational consistency.
Originally posted on Himalayas