Security Engineer at First Advantage in Bangalore Virtual, IN

Job description

The Security Engineer is an intermediate technical individual contributor who investigates and resolves Level 2 and Level 3 SOC escalations, develops and tunes detections, builds approved automation, and contributes to SOC engineering projects. The role applies general knowledge of industry practices, techniques, standards, concepts, and principles to technical problems of moderate scope and complexity. Key Responsibilities Investigate and resolve Level 2 and Level 3 alerts, cases, and incidents using established procedures, playbooks, and escalation paths. Analyze endpoint, identity, email, cloud, network, and application telemetry to validate activity, determine scope, and document findings. Develop, test, deploy, tune, and document detections for defined use cases across SIEM, XDR, EDR, cloud, identity, email, and other telemetry. Develop approved enrichment, triage, notification, containment, and remediation workflows for Tier 1 scenarios that outsourced providers cannot fully address. Perform scoped threat hunts and retrospective searches using documented hypotheses and established analysis methods. Support telemetry onboarding, platform configuration, integrations, and troubleshooting for assigned systems and use cases. Maintain accurate case records, detection documentation, automation runbooks, and technical procedures. Contribute to project milestones and escalate work that exceeds established authority, procedures, or technical scope. Monitor and investigate security events generated from SaaS applications, PaaS platforms, APIs, web applications, and database services, and develop detections, enrichment logic, and response workflows to improve visibility into application-layer threats and unauthorized data access. Core Functional Responsibilities SOC Escalations and Incident Response: Handle both Level 2 and Level 3 escalations within established procedures; conduct evidence gathering, scoping, validation, containment, remediation, recovery support, and case documentation; engage senior responders when authority, impact, or complexity exceeds defined boundaries. Detection Engineering: Build and tune defined detections, queries, correlations, analytics rules, and incident logic; complete testing, peer review, deployment, regression validation, MITRE ATT&CK mapping, and documentation. Tier 1 Automation: Address repeatable Tier 1 gaps that outsourced services cannot resolve by developing approved enrichment, triage, notification, containment, and remediation workflows. SOC Platform Engineering: Support Sentinel, Defender XDR, SOAR, telemetry connectors, case management, and related integrations; troubleshoot assigned platform, rule, data-quality, and automation issues. Application Security Monitoring & Detection Engineering: Develop and maintain detections for suspicious application activity, administrative actions, privilege changes, API abuse, authentication anomalies, database access, and data-exfiltration indicators while validating telemetry quality and monitoring coverage. Threat Hunting and Analysis: Execute scoped hunts and retrospective searches using established hypotheses and methods; document findings and recommend detection or telemetry improvements. Collaboration and Documentation: Coordinate routine technical work with internal teams and service providers; maintain current cases, runbooks, detection documentation, and automation procedures. Leveling Alignment Knowledge and problem solving: Frequent use and general knowledge of industry practices; solves problems of moderate scope and complexity. Discretion and latitude: Works under only very general supervision. Work is reviewed for soundness of judgment and overall adequacy and accuracy. Uses established policies and practices for guidance. Organizational impact: Contributes to milestones associated with specific projects and operational goals. Errors may delay schedules or require additional resources to correct. Internal and external contacts: Primaril