Security Operations Engineer

External

Purestorage · Bangalore, India

Full-timeOn-site1w ago

AWSDocumentationIncident ResponseInformation SecurityMovePython

Cover Letter Connect

Prepare for this interview

Elite

AI-generated questions, company research, and talking points tailored to this role

About the role

You will partner with the security operations lead and broader security team to develop and mature security use cases that apply across the company's environment and operations. Your mission is to build and refine the detections, policies, and response logic that enable the team to identify real attacks, misuse, intrusions, and data loss events with speed and confidence. This is not a passive monitoring role. You will be expected to understand how the business operates, how attackers move, where meaningful signals live, and how to translate that knowledge into durable security content and response workflows. Success in this role is measured not by alert volume, but by signal quality, attack reduction, faster containment, and continuous operational improvement .

Responsibilities

Design, implement, and maintain high-fidelity detections, correlation rules, alerts, dashboards, and use cases in Splunk and related security platforms.

Build detections across multiple data domains, including identity, endpoint, network, cloud infrastructure, SaaS applications, DLP, vulnerability, and asset posture.

Correlate signals from diverse tooling and data sources to identify attacker behavior, misuse, anomalous activity, and material security risk.

Partner with business units, IT, engineering, and internal security stakeholders to map business processes and workloads to security use cases and required telemetry.

Support and participate in incident triage, investigation, containment, and post-incident improvement activities.

Develop enrichment and automation workflows using Python, APIs, and security tooling to improve analyst efficiency and response consistency.

Improve detection quality by tuning noisy alerts, reducing false positives, and increasing true positive rates.

Collaborate on logging strategy, event onboarding, normalization, parsing, correlation, retention, reporting, and platform customization.

Apply threat intelligence, attacker tradecraft, and frameworks such as MITRE ATT&CK, CVE/CVSS, and risk context to drive meaningful detections.

Create playbooks, runbooks, detection documentation, and operational guidance for responders and analysts.

Use lessons learned from incidents, hunts, and threat research to continuously improve content, coverage, and response workflows.

Help mature a security operations model that brings together detection, alerting, investigation, and response rather than treating them as isolated functions.

What You Will Help Build

High-signal detections for credential misuse, privilege abuse, lateral movement, endpoint compromise, cloud and SaaS misuse, suspicious administrative activity, insider risk indicators, and sensitive data movement.

Risk-informed detections that combine activity with identity context, asset criticality, exposure data, vulnerability posture, and threat intelligence .

Response workflows that reduce manual effort and improve speed, consistency, and quality during investigations.

A detection program that focuses on real outcomes : prevention, earlier detection, faster containment, and reduced operational noise.

WHAT YOU BRING

6+ years of experience in cybersecurity, or a related technical field

3+ years of hands-on experience in incident response, detection engineering, security operations, or SIEM engineering

Strong hands-on experience with a SIEM platform; direct experience with Splunk is strongly preferred

Solid understanding of the incident response lifecycle, including triage, scoping, containment, eradication, recovery, and post-incident learning

Strong understanding of foundational networking, systems, cloud, and security principles

Ability to write scripts and automate tasks using Python or a similar language

Ability to work with APIs, integrate data sources, and automate enrichment or response actions

Strong analytical thinking and the ability to translate ambiguous threats or operational gaps into concrete detection logic

Excellent written and verbal communication skills, with the ability to collaborate effectively across technical and non-technical teams

Bachelor's degree in Computer Science, Information Security, Engineering, or a related technical field

Preferred

Exposure to SIEMs (e.g., Splunk) or SOAR platforms (e.g., Tines, XSOAR)

Experience with SOC technologies such as IDS/IPS, UTM firewalls, EDR, anti-virus, network-based threat detection, and netflow.

Familiarity with software development practices and secure coding principles

Experience with cloud-native monitoring (e.g., AWS Config, CloudTrail, Audit Logs)

Security certifica

Security Operations Engineer

About the role

Responsibilities

Additional Information

Your Match

Company Intel

What employees say

Interested in this role?