Deepwatch is seeking a highly motivated, self-driven technical analyst dedicated to protecting organizations against the world's most advanced attackers. Our Security Operations Center offers a unique approach to customer support, delivering an unparalleled experience within the industry. As an integral part of our global team based in India, you will play a pivotal role in understanding our customers' unique environments, needs, and challenges. You will partner closely with U.S.-based leadership and teams, ensuring continuous security operations and successful client outcomes across time zones.

In this role, you’ll get to:

• Support incident handling processes across multiple platforms and security technologies including Windows, Linux and macOS
• Monitor a queue of security events generated by the Deepwatch platform SOAR, triage events based on their criticality, and escalate validated security events to customers
• Document and manage incident cases in our case management system
• Keep up-to-date with information security news, techniques, and trends 
• Identify and report any gaps in log collection or reporting as soon as possible to the customer and Deepwatch Engineering
• Become proficient with Deepwatch supported SIEMs including Splunk, Google Secops, and Microsoft Sentinel, ServiceNow and other third-party threat intelligence tools as required
• Perform security detection analysis and investigations using SIEM and SOAR technologies, leverage Deepwatch proprietary tooling and intelligence and maintain SLA’s
• Act as the first line of defense during security events by triaging and investigating alerts within a customer’s environment
• Produce high-quality written and verbal communications, recommendations, and findings to customer management in a timely manner
• Continue to sharpen your skills and capabilities on the job, and through the Deepwatch development program

To be successful in this role you’ll need:

• 2+ years of experience in cybersecurity or SOC environment
• Know your way around SIEM platforms (Splunk, Google SecOps & Microsoft Sentinel preferred) with the ability to perform queries and leverage various log sources to perform investigations
• Review SIEM alerts and make a determination on what other sources or intelligence is needed to make a determination, relying on peers to help improve your skills and capabilities
• A Degree in Information Security or IT, related training, certifications or on-the-job experience
• A basic understanding of cyber security principles, concepts and practice with a focus on SOC operations, alert triage and investigations
• Ability to collaborate with global teams across time zones to ensure continuous security operations
• Competency with in-depth header analysis, hashes and Windows/macOS/Linux log and file path structures.
• A desire to support others and uplift the program and team 
• Excellent written and verbal communication skills
• Ensure customers receive a thorough and comprehensive breakdown of incident investigations.
• Articulate the process involved in pivoting to other log sources, cloud systems, or consoles to perform a comprehensive analysis from multiple data sources 
• Have a  basic understanding of modern EDR, email security and cloud identity platforms
• Have an understanding of all basic ports and protocols
• Familiarity with OSINT, TTPs and IOCs
• Preferred Certifications: Sec+, CySA+, CEH

Why Deepwatch?

• Mission-driven company focused on protecting customers from threats 24/7
• Hybrid work model in India, with access to collaborative office space in Bangalore
• High-impact leadership role with strong visibility across Product & Engineering
• Competitive compensation, equity, and benefits
• A company recognized as a Great Place to Work® for five consecutive years
• Opportunity to shape the future of cybersecurity and AI-driven platforms