Level: Consultant
Work you'll do
As a Consultant on the Cyber Operate team, you will be responsible for designing, developing, and maintaining security orchestration and automation solutions that improve security operations outcomes.
- Design, develop, and maintain SOAR playbooks to automate alert triage, investigation, enrichment, and response activities.
- Integrate the SOAR platform with Security Information and Event Management, Endpoint Detection and Response, threat intelligence, ticketing, email, Identity and Access Management, firewall, and cloud security tools.
- Collaborate with Security Operations Center analysts, incident responders, and engineering teams to identify automation opportunities, improve response workflows, and optimize use cases that reduce manual effort.
- Use AI-assisted playbook development, AI-augmented alert triage, and incident summarization capabilities to improve automation design, enrichment, case narratives, and escalation decisions.
- Troubleshoot and enhance playbooks, connectors, and integrations; create dashboards and operational metrics; maintain documentation; and support continuous improvement of security operations processes.
The team
Cyber Operate teams manage clients' critical cyber assets either as a fully managed service or in partnership with clients. They deliver skilled talent, cutting-edge technologies, and robust processes to operate client cyber capabilities. This includes managing the identity lifecycle, security operations, threat intelligence, application security, business transformation, and ensuring continuous compliance. Services include Cyber-as-a-Service, Managed Application Security, and Managed Extended Detect & Respond (MXDR).
Location: Bengaluru/Hyderabad/Pune/Chennai
Shift Timings: 2:00 PM to 11:00 PM IST, with flexibility required based on client expectations, engagement demands, and time zone coverage. Provide on-call and after-hours support for critical security incidents, escalations, and operational needs. Flexibility to collaborate with global teams across different time zones as required.
Qualifications
Required:
- 3+ years of experience in cybersecurity, SOAR engineering, or security automation
- Experience with SOAR platforms such as Cortex XSOAR, Splunk SOAR, Swimlane, IBM Resilient, or Tines
- Experience with Security Operations Center operations, Security Information and Event Management workflows, incident response, and case management processes
- Experience integrating application programming interfaces, webhooks, and third-party security products into automation workflows
- Experience with Python, PowerShell, Bash, or JavaScript Object Notation-based workflow logic
- Experience across security domains including endpoint, email, identity, network, cloud, and threat intelligence
- Bachelor’s degree in Computer Science, Cyber Security, Information Security, Engineering, or Information Technology
Preferred:
- Experience with Amazon Web Services, Microsoft Azure, or Google Cloud Platform and their security services
- Experience with MITRE ATT&CK, threat detection engineering, and response orchestration practices
- Experience with ServiceNow or Jira
- Certifications in security, automation, or vendor platforms
- Experience with AI-augmented SOAR capabilities including AI-assisted playbook generation, natural language automation building, and machine learning-based alert triage
- Experience applying large language model concepts to security automation, including prompt engineering, incident summarization, and human-in-the-loop decision frameworks
#Cyber_Cyber Operate