Security Operations Engineer

About the Role

We are seeking a highly skilled Security Operations & Threat Hunter with exceptional troubleshooting abilities and a deep understanding of both endpoint and cloud threats. The ideal candidate will be a key player in our Security Operations Center (SOC), proactively hunting for threats, analyzing security incidents, and ensuring the protection of our infrastructure across on-premise and cloud environments.

This role offers a distinct growth trajectory: beyond day-to-day triage and incident response, you will dedicate meaningful time to high-impact engineering projects, AI-driven security automation, and direct collaboration with senior engineering leadership.

Responsibilities

Monitor, detect, and respond to security incidents across on-premise and cloud environments.

Analyze security alerts from security tools to identify potential threats.

Conduct forensic investigations and deep-dive analysis of security events to identify trends, attack techniques, and areas for improvement.

Conduct proactive threat hunting across endpoint, network, and cloud environments to identify sophisticated cyber threats.

Analyze security logs, behavioral patterns, and anomalies to detect indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).

Investigate security incidents, perform forensic analysis, and provide actionable recommendations for mitigation and remediation.

Develop and refine threat hunting methodologies, leveraging frameworks like MITRE ATT&CK and the Cyber Kill Chain.

Automate threat detection and analysis using scripting languages such as Python, PowerShell, or Bash.

Continuously monitor emerging threats, vulnerabilities, and attack trends to improve detection and response strategies.

Qualifications

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent practical experience).

3+ years of experience in security operations, threat hunting, or a similar cybersecurity role.

Experience working with log data for detection and response across Cloud, EDR, Network, and related telemetry.

Experience developing and deploying effective detection rules (e.g., YARA, Sigma, SQL-based rules, Network signatures).

Strong understanding of network security monitoring, packet analysis, and log correlation.

Deep understanding of advanced threat detection methodologies and threat intelligence.

Proficiency in analyzing attacker tactics, techniques, and procedures (TTPs) based on frameworks like MITRE ATT&CK.

Proficiency in scripting and automation for security operations (Python, PowerShell, or Bash).

Solid understanding of endpoint security, identity management, cloud security, detection engineering, vulnerability management, incident response, and threat intelligence.

Strong communication skills, an inquisitive mindset, and the confidence to ask questions, challenge assumptions, and collaborate across teams.

Working Model & Schedule

Global Exposure & Quarterly Rotations: To foster close alignment with our distributed engineering teams and US leadership, this role follows a structured quarterly time-zone rotation (rotating through San Francisco/PST, New York/EST, and local daytime business hours). This cadence provides direct access to senior leadership, high-visibility global projects, and cross-functional teams across the organization.

Rotational On-Call Coverage: Shared participation in rotational weekend on-call pager duty to triage critical incidents alongside team members and leadership.

Location & Hybrid Flexibility: Based in Bangalore. During local daytime business cycles, work on-site from our Bangalore office to build strong peer relationships and cross-functional connections; flexible remote arrangements apply during global and US-aligned cycles.