Location - Navi Mumbai, India

Position Summary

We are seeking a highly skilled Infrastructure Security Engineer-L2 (Palo Alto & NGFW) responsible for implementation, administration, and support of Palo Alto Next-Generation Firewalls (NGFW) across enterprise and cloud environments. The role involves handling day-to-day operations, incident management, troubleshooting, and TAC coordination, along with contributing to firewall migrations and security enhancements. The engineer will play a key role in maintaining secure and stable network infrastructure for critical business operations.

Key Responsibilities

• Provide L2 support for Palo Alto NGFW environments, including incident handling, troubleshooting, and resolution.
• Manage day-to-day firewall operations, including policy changes, NAT configurations, and VPN management.
• Perform advanced troubleshooting for network and security issues across on-prem and cloud environments (AWS, Azure, GCP, OCI).
• Handle TAC coordination with vendors for critical and complex issues.
• Configure and manage:
• IPSec VPNs, Remote Access VPNs, and Clientless VPNs
• Security policies, NAT rules, and ACLs
• Work on Palo Alto Panorama for centralized management, including templates, log collectors, and policy deployment.
• Implement and support Next-Generation Firewall features such as:
• Threat Prevention
• URL Filtering
• Content Filtering
• Data Loss Prevention (DLP)
• User-ID
• Participate in and execute firewall migration projects (e.g., Cisco ASA to Palo Alto).
• Support IDS/IPS administration and monitoring, including performance tuning and alert handling.
• Perform change management activities in line with ITIL processes.
• Prepare and maintain technical documentation including HLD, LLD, SOPs, and knowledge base articles.
• Conduct security assessments, gap analysis, and recommend improvements in security architecture.
• Collaborate with L3 teams and stakeholders for design improvements and complex issue resolution.
• Provide inputs for network security strategy, transformation projects, and infrastructure planning.

Technical Skills

• Strong hands-on experience with Palo Alto NGFW (PAN-OS) and its advanced features.
• Working knowledge of Palo Alto Panorama (templates, device groups, log collectors).
• Experience with Cisco ASA firewalls and firewall migration projects.
• Strong understanding of:
• Network Security concepts
• OSI Model & TCP/IP protocols
• Routing & Switching fundamentals
• Expertise in:
• IPSec VPN configuration & troubleshooting
• NAT, ACLs, and security policy management
• Exposure to cloud security networking in:
• AWS
• Azure
• GCP
• OCI
• Knowledge of IDS/IPS systems and threat prevention mechanisms.

Basic Qualifications

• Bachelor’s degree in Engineering (B.E./B.Tech – CSE, IT, ECE) or MCA / M.Sc (Computer Science).
• Minimum 5+ years of experience in network security and firewall management.
• Hands-on experience in Palo Alto firewall administration and troubleshooting.
• Strong analytical, problem-solving, and communication skills.

Preferred Qualifications

• PCNSE (Palo Alto Networks Certified Network Security Engineer) certification.
• CCNP Security or equivalent certification.
• Experience in enterprise datacentre and cloud security deployments.

About the Role

We are seeking a highly skilled Security Analyst (Level 2) to join our MSSP SOC team. The ideal candidate will have expertise in SIEM (Splunk, QRadar), XDR/EDR solutions, and security analysis with hands-on experience in investigating and responding to security alerts. This role requires proficiency in reviewing and analyzing Level 1 alerts, providing detailed recommendations, and engaging with customers for incident handling. The candidate should also have basic SIEM administration knowledge and Python scripting skills for troubleshooting and playbook development.

Key Responsibilities

• Threat Detection & Response: Analyze and investigate security alerts, events, and incidents generated by SIEM, XDR, and EDR solutions.
• Incident Investigation & Handling: Conduct in-depth security incident investigations, assess impact, and take appropriate actions. 
• Incident Escalation & Communication: Escalate critical incidents to Level 3 analysts or senior security teams while maintaining detailed documentation.
• Content Management: Develop and fine-tune correlation rules, use cases, and alerts in SIEM/XDR platforms to improve detection accuracy.
• Malware Analysis: Perform basic malware analysis and forensic investigation to assess threats.
• Customer Request Handling: Collaborate with customers to address security concerns, provide recommendations, and respond to inquiries.
• SIEM Administration: Assist in the administration and maintenance of SIEM tools like Splunk or QRadar, ensuring smooth operations.
• Automation & Playbooks: Utilize Python scripting for automation, troubleshooting, and playbook development to enhance SOC efficiency.
• Reporting & Documentation: Prepare detailed reports on security incidents, trends, and mitigation strategies. 

Basic Qualifications

• B.E/B. Tech degree in computer science, Information Technology, Masters in Cybersecurity
• 3+ years of experience in a SOC or cybersecurity operations role.
• Strong knowledge of SIEM tools (Splunk, QRadar) and XDR/EDR solutions.
• Hands-on experience in threat detection, security monitoring, and incident response.
• Knowledge of network security, intrusion detection, malware analysis, and forensics.
• Basic experience in SIEM administration (log ingestion, rule creation, dashboard management).
• Proficiency in Python scripting for automation and playbook development.
• Good understanding of MITRE ATT&CK framework, security frameworks (NIST, ISO 27001), and threat intelligence.
• Strong analytical, problem-solving, and communication skills.
• Ability to work in a 24x7 SOC environment (if applicable)

Preferred Qualifications

• Certified SOC Analyst (CSA)
• Certified Incident Handler (GCIH, ECIH)
• Splunk Certified Admin / QRadar Certified Analyst
• CompTIA Security+ / CEH / CISSP (preferred but not mandatory

About the role

We are seeking an experienced and strategic manager to lead and scale our Security Operations Center (SOC). The ideal candidate will be a proven people leader with strong technical expertise in security operations, capable of driving operational excellence, managing a multi-tiered analyst team, and acting as the primary interface between the SOC and executive stakeholders. The SOC Manager will be responsible for SOC delivery, SLA performance across all client engagements, and will champion continuous improvement across people, processes, and technologies, with the ability to scale operations to a 24x7 model as the business evolves.

Key Roles & Responsibilities:

SOC Operations Leadership

• Own the end-to-end performance and delivery of the SOC across all shifts and analyst tiers (L1, L2, L3).
• Define, monitor, and enforce SLAs, KPIs, and OKRs across all client SOC engagements.
• Build and maintain SOC runbooks, playbooks, and standard operating procedures.
• Ensure continuous 24x7 SOC coverage through effective workforce planning and shift management.
• Serve as the final escalation point for high-severity incidents and critical client situations.

Team Management & Development

• Recruit, onboard, and retain a high-performing team of SOC analysts across L1, L2, and L3 levels.
• Conduct regular performance reviews, career development planning, and skills gap assessments.
• Provide coaching and mentorship to build a strong talent pipeline within the SOC.
• Foster a culture of accountability, continuous learning, and operational discipline.
• Manage team scheduling, leave planning, and capacity to ensure uninterrupted operations.

Incident Response Oversight

• Oversee the investigation and resolution of high-severity and P1 security incidents.
• Ensure incident response procedures — containment, eradication, and recovery — are consistently followed.
• Lead post-incident reviews and drive implementation of lessons learned across the team.
• Communicate incident status, impact, and remediation updates to client stakeholders and internal leadership.

Client & Stakeholder Management

• Act as the primary SOC point of contact for strategic client relationships.
• Deliver regular SOC performance reviews, threat landscape briefings, and security posture reports to client executives.
• Collaborate with client IT and security teams to ensure alignment on SOC scope and service effectiveness.
• Manage escalations and ensure client satisfaction through proactive communication and issue resolution.

Threat Intelligence & Threat Hunting Strategy

• Define and oversee the SOC threat intelligence program, ensuring operationalization of feeds across SIEM and detection tools.
• Direct proactive threat hunting initiatives and ensure findings feed back into detection engineering.
• Stay current on the evolving threat landscape and translate emerging attack techniques into actionable SOC improvements.

Security Tool & Technology Governance

• Oversee the selection, deployment, and optimization of security technologies including SIEM (XSIAM/Splunk/QRadar), EDR, XDR, SOAR, and threat intelligence platforms.
• Drive tool rationalization and ensure maximum value from the security technology stack.
• Partner with engineering and architecture teams to evaluate and onboard new tools as the threat landscape evolves.

Metrics, Reporting & Continuous Improvement

• Develop and maintain a comprehensive SOC metrics framework covering MTTR, MTTD, detection rates, false positive ratios, and SLA adherence.
• Produce executive-level and client-facing SOC performance reports on a regular cadence.
• Identify process gaps and lead initiatives to improve analyst efficiency, detection fidelity, and response times.
• Champion SOAR adoption and automation to reduce manual workload and accelerate response.

Compliance & Regulatory Governance

• Ensure SOC operations meet applicable compliance requirements (e.g., GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001).
• Support client audit activities and produce compliance-relevant documentation and evidence.
• Maintain awareness of evolving regulatory requirements affecting security operations.

Cross-Functional Collaboration

• Partner with DFIR, Vulnerability Management, Network Security, and Cloud Security teams to deliver integrated security services.
• Collaborate with MSSPs, OEM vendors, and external threat intelligence partners to strengthen SOC capabilities.
• Work with sales and solution teams to support pre-sales activity, SOC capability presentations, and new client onboarding.

Budget & Resource Planning

• Contribute to SOC budget planning, headcount forecasting, and resource allocation decisions.
• Track and manage operational costs related to tooling, staffing, and third-party services.
• Identify and justify investments in new capabilities that improve security outcomes and operational efficiency.

 Basic Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 8+ years of experience in information security, including experience leading SOC operations or teams.
• Strong hands-on experience with SOC operations, SIEM platforms (e.g., Splunk, QRadar), and incident response.
• Proven ability to manage client relationships and communicate effectively with both technical and executive stakeholders.
• Solid understanding of threat intelligence, threat hunting, and industry security frameworks (e.g., MITRE ATT&CK, NIST, CIS).

 Preferred Qualifications:

• Relevant certifications such as CISSP, CISM, GCIA, or GCIH.
• Experience with SIEM platforms (e.g., Splunk, XSIAM, QRadar) and security tooling.
• Experience with SOAR platforms and security automation.
• Knowledge of cloud security (AWS, Azure, GCP) and hybrid SOC environments.
• Experience in managed security services, including multi-tenant environments or pre-sales support.

About the role

We are seeking a highly skilled Security Analyst to join our Security Operations Center (SOC) team. The ideal candidate should have a strong foundation in SIEM monitoring & XDR or EDR solutions, and security analysis, with hands-on experience in investigating and responding to security alerts. This role requires expertise in reviewing and analyzing L1 alerts, providing detailed recommendations, and engaging with customers for incident handling. The candidate should also have a basic SIEM administration background and Python scripting skills for troubleshooting and playbook development.  

Key Roles & Responsibilities:  

 Incident Detection and Response

• Analyze and Respond to Security Alerts: Review and investigate security alerts escalated from L1 analysts or generated by security monitoring tools (SIEM, IDS/IPS, EDR). 

• Incident Triage: Conduct initial analysis of potential security incidents to determine severity, impact, and scope, including identifying false positives. 

• Incident Escalation: If necessary, escalate incidents to L3 SOC analysts for deeper investigation and remediation. 

• Containment: Take appropriate containment actions to limit the impact of ongoing security incidents (e.g., isolating affected systems, blocking malicious IP addresses). 

• Incident Documentation: Accurately document and report security incidents in a clear and comprehensive manner for later analysis and compliance requirements. 

 Threat Hunting and Monitoring

• Proactive Threat Hunting: Identify potential threats and vulnerabilities by analyzing logs, network traffic, and other security data to find hidden threats or weaknesses. 

• Monitor Security Systems: Regularly monitor and assess security infrastructure, including firewalls, intrusion detection systems, and endpoint protection tools, to detect anomalies and potential attacks. 

• Alert Tuning: Adjust and refine alerts within security tools (SIEM, XDR) to improve detection and reduce false positives. 

 Security Tool Management

• Security Systems and Tools Management: Assist in the configuration, management, and maintenance of security tools (e.g., SIEM & XDR tools) to ensure effective threat detection. 

• Log Review: Review logs from various sources such as network devices, servers, and applications to identify security events or irregular activities. 

• SIEM & XDR Management: Ensure SIEM & XDR tools are operating properly, fine-tune them for better accuracy, and perform searches on security data. 

Collaboration and Escalation 

• Work with L1 Analysts: Provide guidance and mentorship to L1 analysts on how to identify and escalate security incidents appropriately. 

• Collaborate with Other Teams: Coordinate with internal teams (network security, IT operations, application security, etc.) to address vulnerabilities, incidents, and other security concerns. 

• Incident Escalation to L3: For complex or advanced incidents, escalate issues to L3 analysts for deeper investigation and remediation. 

Customer Communication & Incident Handling 

• Engage with customers during security incidents and provide expert guidance. 

• Conduct technical discussions to explain security threats and mitigation steps. 

• Collaborate with internal and external teams for incident resolution. 

Playbook Management & Troubleshooting 

• Understand and modify XDR playbooks to automate security operations. 

• Troubleshoot playbook errors and optimize automation workflows. 

• Identify gaps in existing security automation and recommend enhancements 

 Security Reporting and Documentation

• Prepare Incident Reports: Document detailed incident reports and provide analysis on the severity and impact of security events for management and other stakeholders. 

• Generate Logs and Metrics: Provide regular reports and metrics on security operations, highlighting trends, incidents, and areas of improvement. 

• Compliance Reporting: Ensure that incident records meet internal and external compliance and regulatory requirements (e.g., GDPR, HIPAA, PCI DSS). 

Continuous Improvement

• Contribute to the development and improvement of SOC procedures, workflows, and tools to enhance the efficiency of security monitoring and incident response. 

• Stay Current with Threats: Continuously update knowledge on emerging cybersecurity threats, trends, tools, and techniques to improve threat detection and response. 

• Contribute to Training: Assist in training and developing junior staff (L1 analysts), ensuring the team’s overall readiness to handle incidents. 

 Basic Qualifications: 

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field
• 3+ years of experience in security operations, SIEM, or IT security with solid foundational knowledge
• Hands-on experience with SIEM tools (e.g., Splunk, ArcSight, QRadar), endpoint protection, and IDS/IPS
• Strong understanding of IT infrastructure, networking, and core cybersecurity principles
• Excellent communication, problem-solving skills, and attention to detail

Preferred Qualifications: 

• Relevant security certifications such as CISSP, CISM, GCIA, GCIH, or equivalent
• Experience with modern SIEM platforms (e.g., Palo Alto XSIAM, Google SecOps, FortiSIEM, Splunk)
• Exposure to SOAR platforms and security automation workflows
• Knowledge of cloud security across AWS, Azure, or GCP environments
• Experience working in hybrid or cloud-based SOC environments

Position summary:

We are seeking a skilled Security Consultant to join our Security Operations Center (SOC) team. The ideal candidate will have a strong background in SOC operations and will ensure the SOC team is performing its functions as required, including troubleshooting incidents and events. The ideal Security Consultant will also act as the technical subject matter expert (SME), handling critical SOC tasks, and guiding Level 1 and Level 2 customer communications.

Key Roles & Responsibilities:

Incident Response and Management

• Lead the investigation of high-severity security incidents and breaches.
• Provide expert analysis for complex incidents that L1 and L2 analysts cannot resolve.
• Develop and execute incident response procedures, including containment, eradication, and recovery.
• Ensure proper escalation processes are followed for incidents requiring higher expertise.
• Communicate with stakeholders, such as management and IT teams, to ensure appropriate handling of incidents.

Threat Hunting and Analysis

• Perform proactive threat hunting activities to identify potential vulnerabilities, threats, and attacks before they happen using Splunk / QRadar SIEM.
• Use threat intelligence feeds to enrich SOC operations and identify emerging threats.
• Analyze large volumes of security data to detect patterns and anomalies.

Security Tool Management

• Oversee and optimize the usage of security monitoring tools such as Splunk/ QRadar SIEM (Security Information and Event Management), IDS/IPS (Intrusion Detection/Prevention Systems), and endpoint protection systems.
• Configure, update, and fine-tune security tools to improve detection capabilities and reduce false positives.
• Recommend new security tools and technologies to improve SOC operations.

Log and Event Analysis

• Review logs from various sources (network, endpoints, servers, etc.) to identify security incidents.
• Ensure accurate log data collection and retention practices are followed.
• Provide in-depth analysis of security alerts and generate reports.

Vulnerability Management

• Conduct vulnerability assessments and prioritize remediation activities for critical vulnerabilities.
• Collaborate with the IT and development teams to address security flaws and implement patches.

Collaboration and Escalation

• Serve as the point of escalation for L1 and L2 SOC analysts when complex issues arise.
• Collaborate with other security teams, such as network security, application security, and IT operations, to ensure a comprehensive defense strategy.
• Work with external partners, including Managed Security Service Providers (MSSPs), to coordinate incident management and threat intelligence sharing.

Security Policies and Best Practices

• Review and recommend improvements to security policies, procedures, and best practices.
• Ensure that the organization's security policies are being followed and advise on improvements.
• Conduct regular security awareness training for SOC staff and the broader organization.

Reporting and Documentation

• Generate detailed reports on incidents, security posture, and threats for senior management and relevant stakeholders.
• Maintain incident logs and documentation to comply with regulatory and internal policies.
• Ensure all incidents are well-documented with root cause analysis, remediation efforts, and lessons learned.

Continuous Improvement

• Analyze the effectiveness of the SOC's operations and suggest improvements to processes, workflows, and technologies.
• Stay updated on the latest cyber threats, tools, and techniques.
• Assist with the development and execution of simulations, exercises, and training to improve SOC capabilities.

 Compliance and Regulatory Requirements

• Ensure compliance with SLAs for all projects.
• Ensure SOC operations meet industry compliance requirements (e.g., GDPR, HIPAA, PCI DSS).
• Help in audits and compliance assessments related to security operations.

Mentoring and Training

• Provide mentorship and training to junior SOC analysts (L1 and L2).
• Share knowledge on advanced attack techniques, response strategies, and threat detection methods.

Report deviations and concerns to the SOC Manager

 Basic Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 5+ years of experience in security operations, SIEM, or IT security.
• Hands-on experience with SOC operations, incident response, and security monitoring.
• Solid understanding of cybersecurity fundamentals, networking, and IT infrastructure.
• Strong problem-solving skills and ability to communicate effectively with technical and non-technical stakeholders.

Preferred Qualifications:

• Relevant certifications such as CISSP, CISM, GCIA, or GCIH.
• Experience with SIEM platforms (e.g., Splunk, XSIAM, QRadar) and security tools.
• Experience with SOAR platforms and security automation.
• Knowledge of cloud security (AWS, Azure, GCP) and hybrid SOC environments.
• Familiarity with enterprise security tools (e.g., EDR, XDR, WAF, DLP) and managed SOC environments.