147 Incident Response jobs in Hyderabad

Job Title :- Cyber Security Engineer

Experience: 6 to 9Years

Location: Hyderabad, Chennai

Virtual Drive : 10am to 4pm

Job Description:

Desired Competencies (Technical/Behavioral Competency)

Must-Have**

(Ideally should not be more than 3-5)

Continuously monitor:

• Monitor security alerts and events from various sources, including Microsoft Sentinel, Defender for Endpoint and Defender for Cloud.
• Perform log management: Perform log ingestion, define use cases, and create alerts for critical assets.
• Develop Detection Rules: Create, implement, and fine-tune analytical rules, alerts, and queries in Microsoft Sentinel and Defender to detect security incidents and reduce false positives.
• Behavioral Analytics: Leverage user and entity behavior analytics (UEBA) to identify abnormal activities and enhance detection capabilities.
• Customize Playbooks: Develop and customize automation playbooks in Sentinel and defender to streamline incident response processes and improve efficiency.
• Threat Hunting: Using IOCs and threat intelligence, perform threat hunting across environment.

Incident Response

• Analyze and investigate security incidents to identify potential threats.
• Respond promptly to security incidents, provide initial analysis, conduct business impact assessment, isolate, eradicate and recover from threats.
• Document and report incidents, ensuring accurate and comprehensive records.
• Follow established incident response procedures, playbooks and contribute to their enhancement.

Testing and Validation

• Participate in Blue RedPurple team exercises.
• Participate in Cyber crisis simulations.
• Participate in Table-top exercises.

Business Context and Risk Management

• Understand the Business value chain.
• Understand key Business processes.
• Understanding the Business architecture and mapping to crown jewels (critical assets)
• Risk management with the ability to conduct risk assessments when required.

Endpoint Detection and Response (EDR)

• Manage and maintain endpoint security and compliance.
• Perform daily health checks endpoint security and EDR solutions and remediate accordingly.
• Conduct regular scans and assessments to identify and mitigate potential vulnerabilities.
• Collaborate with IT teams to ensure endpoint security configurations align with organizational standards.

Good-to-Have Skills/ Competencies

• Communication: Excellent written and verbal communication skills in English, with the ability to effectively communicate technical information to both technical and non-technical audiences.
• Collaboration: Willing and able to share knowledge and learn from colleagues
• Time Management: Ability to work in independent environments under aggressive timelines and pressure.
• Reporting skills: Outstanding written skills for preparing email feedback and incident reports
• Ability to manage stress and pressure.
• Passion for continuous learning and development
• A “go getter” who is willing to go the extra mile to identify problems and recommend innovative solutions.

SN

Responsibility of / Expectations from the Role

1

Must have 4+ years’ experience in a SOC or Cybersecurity related role.

2

Candidates with the following technology experiences will be preferred: Microsoft Defender XDR, EDR, JAMF, Symantec DCS, DNS, network security, Online Brand Protection platforms, Mimecast, Symantec DLP, Next DLP, FortiAnalyzer, Sophos, CrowdStrike and Azure Sentinel.

3

Experience with common information technologies (Windows, VMware, and Cisco as well as some UNIX, Linux).

4

Experience with security tools (WAF, Proxy, DNS, IDS, firewalls, anti-virus, data loss prevention, Azure Entra ID, IAM, PAM, MFA, NAC, DLP).

5

Knowledge of Cloud Security Operations (SaaS, PaaS, IaaS), Mobile Architecture, Network and Application Security and/or Data Protection.

6

Effective verbal and written communication skill

Major Incident Manager (Escalation Management Team)

Location: Hyderabad

Experience: 8-15 years

Immediate Joiner preferred.

Kindly share resume to with Sub of "MIM" along with notice period.

Responsibilities

We are seeking a proactive and skilled Major Incident Manager to join our Escalation Management team. In this critical role, you will lead high-priority incident bridges to ensure rapid service restoration by coordinating with resolver groups and keeping stakeholders informed with timely updates. You will work closely with internal teams across SRE, Business Partners, R&D, Services, Sales, and Support, as well as with customers, to drive resolution of critical technical issues and provide executive-level visibility into incident status and customer impact. This role requires availability during CST hours and includes shift work and/or on-call responsibilities to ensure 24/7 incident coverage and timely communication to leadership.

- Serve as the first escalation point for the Event Management team and lead major incident bridges to ensure rapid service restoration.

- Act as the single point of contact for complex, high-priority escalations across global teams.

- Own and drive the end-to-end resolution of major incidents, including coordination with resolver groups and timely stakeholder communication.

- Collaborate with cross-functional teams (R&D, Product Management, Support, Sales, and Services) to troubleshoot issues and allocate appropriate resources.

- Monitor incident progress and ensure alignment with resolution timelines and customer expectations.

- Conduct Post-Incident Reviews, prepare customer facing summaries and internal incident reports to capture lessons learned and drive improvements.

- Own and manage problems, ensuring timely updates, resolution, and closure.

- Partner with Engineering, P&T, and Process Owners to improve service stability and reduce incident recurrence.

- Analyze escalation trends and risks, contributing to the Problem Management lifecycle and continuous service improvement.

- Maintain clear communication with internal and external stakeholders via email and Microsoft Teams.

- Develop and maintain escalation management plans, including resource coordination and technical action plans.

- Initiate hierarchical escalations when necessary and ensure leadership engagement.

- Ensure accurate documentation of escalation activities and compliance with escalation policies.

- Validate customer satisfaction before closure and ensure post-resolution monitoring is completed.

- Provide event management support during low-incident periods.

- Participate in a shared 24x7 on-call rotation to ensure incident coverage and timely response.

- Adhere to the critical service level agreements defined for the project

- Champion a culture of continuous improvement by challenging outdated processes, identifying inefficiencies, and driving structured, actionable plans for enhancement.

- Ensure strict adherence to critical service level agreements (SLAs) and operational standards.

- Demonstrate thought leadership by incorporating industry best practices from leading product and startup environments to enhance incident and major incident management processes.

- Promote the adoption of AI and automation to streamline outage management and improve response efficiency.

- Encourage open communication, proactively raise concerns, and collaborate cross-functionally to resolve systemic issues.

Qualifications

Minimum qualifications

Bachelor's Degree required. Preferably in Computer Science, Information Systems, or related field.

Preferred qualifications

- Excellent verbal and written communication skills in English.

- Relevant years of experience in global Major Incident Management or a similar role, with a strong background in handling incidents across complex technical environments.

- Working knowledge of infrastructure components such as hypervisors, storage, databases, networking (TCP/IP, iSCSI, VMware VDS), and compute environments on both Windows and Linux platforms.

- Familiarity with cloud platforms including AWS, Azure, and GCP, with a solid understanding of core cloud and infrastructure concepts.

- Experience managing major incidents involving cloud services, infrastructure, and enterprise applications.

- Proficient in ServiceNow (Incident, Problem, Change, and Service Request modules), PagerDuty, Microsoft Teams, Power Automate, New Relic, Harness, and MS Copilot.

- Understanding of web and application servers (IIS, Apache, Tomcat) and database technologies such as Microsoft SQL Server.

- Exposure to monitoring tools like AppDynamics, SolarWinds, New Relic, SCOM, Nagios, or Zenoss.

- Basic scripting skills in PowerShell or similar tools.

- Hands-on experience with ITSM platforms, preferably ServiceNow.

Role: Senior Cybersecurity SOC Engineer – Threat Hunting & Incident Response

Working Hours: Monday to Friday, 9 AM – 5 PM PST (U.S. Business Hours)

Reporting To: Security Operations (SecOps) Leader – USA

About the Role: We are seeking an elite Senior Cybersecurity SOC Engineer—a hands-on security expert with deep technical knowledge and proven experience in threat hunting, incident response, and SOC program maturity. This role will report directly to the SecOps Manager in India and requires someone who thrives in a collaborative environment and leads by example. If you are a true expert with Microsoft Sentinel, CrowdStrike, MDE, SOAR platforms, MITRE ATT&CK framework, APT detection, and scripting, this role offers a great opportunity to build and defend a modern SOC environment.

Please note: This is not a SOC Analyst role. Candidates must have 7-10+ years of hands-on SOC Engineer experience with deep threat hunting and incident response expertise. Must be available to work U.S. business hours (PST timezone).

Key Responsibilities:

• Threat Hunting:
• Lead proactive threat hunting initiatives aligned with MITRE ATT&CK framework to identify, investigate, and mitigate advanced threats and adversary behaviors.
• Use telemetry from Microsoft Sentinel, CrowdStrike Falcon, MDE, and other tools to detect anomalies and emerging attack patterns.
• Develop and optimize threat hunting queries and playbooks using KQL, Python, and PowerShell.
• Continuously improve detection coverage to reduce dwell time and prevent breaches.
• Incident Response:
• Design, implement, and maintain an effective Incident Response (IR) program and playbooks covering APTs, ransomware, insider threats, and complex multi-stage attacks.
• Lead investigations on high-fidelity security alerts, conduct root cause analysis, containment, eradication, and recovery.
• Utilize CrowdStrike Falcon EDR (including RTR), Microsoft Defender for Endpoint, and Tenable for comprehensive endpoint and vulnerability correlation during incidents.
• Perform network forensics and packet analysis using Fortinet and Palo Alto firewall logs.
• Manage cloud security incidents within Azure (Azure Sentinel, Security Center) and Microsoft 365 environments.
• Coordinate with internal teams and external partners for timely, coordinated response to security incidents.
• SOC Engineering & Program Maturity:
• Build and mature the SOC’s SIEM and SOAR architecture, detection engineering, and response automation.
• Develop advanced detection logic, hunting queries, and automation workflows.
• Mentor junior SOC members and act as a technical escalation point.
• Collaborate with managed SOC partners and other security teams to enhance detection and response capabilities.

Required Experience & Skills:

• 7+ years of hands-on experience in SOC engineering, with a strong focus on threat hunting and incident response.

Expertise in:

• Microsoft Sentinel (SIEM & SOAR) and advanced KQL queries for hunting and IR
• CrowdStrike Falcon EDR (RTR, IOAs, threat containment)
• Microsoft Defender for Endpoint (MDE) telemetry and IR
• Tenable vulnerability correlation during investigations
• Fortinet and Palo Alto firewalls for forensic analysis
• Microsoft Entra ID (Azure AD), SSO, Conditional Access, MFA security controls
• Deep operational knowledge of MITRE ATT&CK for threat hunting, detection tuning, and adversary simulation.
• Proven ability to analyze and respond to APTs, malware persistence, lateral movement, privilege escalation, command & control, and data exfiltration incidents.
• Strong scripting skills (KQL, Python, PowerShell) for threat hunting automation and incident response workflows.
• Experience with SOAR platforms integration and automation (Microsoft Sentinel SOAR, Palo Alto XSOAR).
• Excellent communication, collaboration, and mentoring abilities.
• Must be able to work U.S. business hours (PST timezone).

Preferred Certifications:

• GCFA, GCIH, GCTI, CISSP, AZ-500, MS-500, or equivalent.
• MITRE ATT&CK Defender (MAD), OSCP, or Red Team certifications are a strong plus.

Role: Senior Cybersecurity SOC Engineer – Threat Hunting & Incident Response

Working Hours: Monday to Friday, 9 AM – 5 PM PST (U.S. Business Hours)

Reporting To: Security Operations (SecOps) Leader – USA

About the Role: We are seeking an elite Senior Cybersecurity SOC Engineer—a hands-on security expert with deep technical knowledge and proven experience in threat hunting, incident response, and SOC program maturity. This role will report directly to the SecOps Manager in India and requires someone who thrives in a collaborative environment and leads by example. If you are a true expert with Microsoft Sentinel, CrowdStrike, MDE, SOAR platforms, MITRE ATT&CK framework, APT detection, and scripting, this role offers a great opportunity to build and defend a modern SOC environment.

Please note: This is not a SOC Analyst role. Candidates must have 7-10+ years of hands-on SOC Engineer experience with deep threat hunting and incident response expertise. Must be available to work U.S. business hours (PST timezone).

Key Responsibilities:

• Threat Hunting:
• Lead proactive threat hunting initiatives aligned with MITRE ATT&CK framework to identify, investigate, and mitigate advanced threats and adversary behaviors.
• Use telemetry from Microsoft Sentinel, CrowdStrike Falcon, MDE, and other tools to detect anomalies and emerging attack patterns.
• Develop and optimize threat hunting queries and playbooks using KQL, Python, and PowerShell.
• Continuously improve detection coverage to reduce dwell time and prevent breaches.
• Incident Response:
• Design, implement, and maintain an effective Incident Response (IR) program and playbooks covering APTs, ransomware, insider threats, and complex multi-stage attacks.
• Lead investigations on high-fidelity security alerts, conduct root cause analysis, containment, eradication, and recovery.
• Utilize CrowdStrike Falcon EDR (including RTR), Microsoft Defender for Endpoint, and Tenable for comprehensive endpoint and vulnerability correlation during incidents.
• Perform network forensics and packet analysis using Fortinet and Palo Alto firewall logs.
• Manage cloud security incidents within Azure (Azure Sentinel, Security Center) and Microsoft 365 environments.
• Coordinate with internal teams and external partners for timely, coordinated response to security incidents.
• SOC Engineering & Program Maturity:
• Build and mature the SOC’s SIEM and SOAR architecture, detection engineering, and response automation.
• Develop advanced detection logic, hunting queries, and automation workflows.
• Mentor junior SOC members and act as a technical escalation point.
• Collaborate with managed SOC partners and other security teams to enhance detection and response capabilities.

Required Experience & Skills:

• 7+ years of hands-on experience in SOC engineering, with a strong focus on threat hunting and incident response.

Expertise in:

• Microsoft Sentinel (SIEM & SOAR) and advanced KQL queries for hunting and IR
• CrowdStrike Falcon EDR (RTR, IOAs, threat containment)
• Microsoft Defender for Endpoint (MDE) telemetry and IR
• Tenable vulnerability correlation during investigations
• Fortinet and Palo Alto firewalls for forensic analysis
• Microsoft Entra ID (Azure AD), SSO, Conditional Access, MFA security controls
• Deep operational knowledge of MITRE ATT&CK for threat hunting, detection tuning, and adversary simulation.
• Proven ability to analyze and respond to APTs, malware persistence, lateral movement, privilege escalation, command & control, and data exfiltration incidents.
• Strong scripting skills (KQL, Python, PowerShell) for threat hunting automation and incident response workflows.
• Experience with SOAR platforms integration and automation (Microsoft Sentinel SOAR, Palo Alto XSOAR).
• Excellent communication, collaboration, and mentoring abilities.
• Must be able to work U.S. business hours (PST timezone).

Preferred Certifications:

• GCFA, GCIH, GCTI, CISSP, AZ-500, MS-500, or equivalent.
• MITRE ATT&CK Defender (MAD), OSCP, or Red Team certifications are a strong plus.