Senior Security Architect
Posted Updated 2
views
Summary
Despite the 'Architect' title, this is a senior hands-on security operations role: monitoring alerts, threat hunting, and investigating/responding to incidents using SIEM (Microsoft Sentinel, Splunk, QRadar) and EDR (Defender, CrowdStrike) tools. 8–10 years of SOC/IR experience, full-time on-site in Hyderabad with a 5:30 PM–2:30 AM IST shift.
Job Description: Senior Security Architect
Experience: 8–10 Years
Work Location: Hyderabad, India – Work From Office
Employment Type: Full-Time
Shift: 5:30 PM – 2:30 AM IST
Position Overview
We are seeking an experienced Senior Security Architect with 8–10 years of hands-on experience in cybersecurity operations, security monitoring, threat detection, incident investigation, and response.
The ideal candidate will have strong technical expertise in identifying, analyzing, and responding to security incidents, investigating suspicious activities, analyzing security alerts, and supporting vulnerability remediation. This role focuses on day-to-day security operations and incident response rather than enterprise security architecture, governance, or people management.
Key Responsibilities
1. Security Monitoring & Threat Detection
- Monitor security alerts, events, and suspicious activities across enterprise systems, networks, endpoints, and cloud environments.
- Analyze security events and identify potential threats, malicious activities, and indicators of compromise (IOCs).
- Investigate alerts generated by SIEM, EDR, and other security monitoring tools.
- Perform log analysis and correlate security events across multiple sources to identify potential incidents.
- Identify patterns of suspicious behavior and recommend appropriate remediation actions.
2. Security Incident Response
- Investigate, triage, contain, and support the remediation of cybersecurity incidents.
- Respond to incidents involving malware, phishing, unauthorized access, compromised accounts, endpoint threats, and suspicious network activity.
- Perform root-cause analysis and document incident findings, timelines, and corrective actions.
- Collect and analyze relevant logs and security evidence to support investigations.
- Coordinate with infrastructure, network, application, and IT support teams to resolve incidents.
- Support incident recovery and post-incident reviews to help prevent recurrence.
3. SIEM, EDR & Security Tools
- Work hands-on with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or similar tools.
- Use endpoint detection and response (EDR) solutions such as Microsoft Defender for Endpoint, CrowdStrike, or similar platforms.
- Investigate alerts using endpoint telemetry, authentication logs, network logs, and cloud security events.
- Develop or fine-tune detection rules, alert thresholds, and correlation logic to improve threat detection.
- Use security dashboards, queries, and investigation tools to identify and analyze potential threats.
4. Threat Hunting & Vulnerability Management
- Perform proactive threat hunting to identify suspicious activities that may not trigger standard security alerts.
- Analyze indicators of compromise, threat intelligence feeds, and emerging attack techniques.
- Support vulnerability identification, prioritization, remediation tracking, and validation.
- Assist in investigating security weaknesses and recommend practical mitigation measures.
- Apply knowledge of common attack techniques, including those described in the MITRE ATT&CK framework.
5. Security Operations & Documentation
- Follow established security incident response procedures, escalation processes, and service-level agreements (SLAs).
- Maintain accurate incident records, investigation notes, evidence, and remediation documentation.
- Prepare incident summaries and operational reports for relevant technical stakeholders.
- Collaborate with SOC, infrastructure, IAM, network, and application teams to strengthen day-to-day security operations.
- Participate in continuous improvement of security monitoring, incident handling, and response processes.
Requirements
- 8–10 years of hands-on experience in cybersecurity, security operations, SOC, threat detection, or incident response.
- Strong practical experience investigating and responding to security incidents.
- Hands-on experience with one or more SIEM platforms, such as Microsoft Sentinel, Splunk, or IBM QRadar.
- Experience with EDR tools such as Microsoft Defender for Endpoint, CrowdStrike, or similar solutions.
- Strong knowledge of security event analysis, log correlation, incident triage, and root-cause investigation.
- Experience responding to phishing, malware, endpoint compromise, suspicious authentication, and unauthorized access incidents.
- Working knowledge of network security, endpoint security, identity and access management, and cloud security fundamentals.
- Familiarity with incident containment, eradication, recovery, and post-incident analysis.
- Knowledge of common cyberattack techniques, indicators of compromise, and threat intelligence.
- Understanding of vulnerability management and security remediation practices.
- Strong troubleshooting, analytical, and problem-solving skills.
- Good communication skills and the ability to collaborate effectively with technical teams.
Preferred Qualifications
- Experience with Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, or IBM QRadar.
- Familiarity with MITRE ATT&CK, threat hunting, and detection engineering.
- Knowledge of incident response playbooks and digital forensics fundamentals.
- Exposure to AWS, Microsoft Azure, or other cloud security monitoring tools.
- Familiarity with scripting or query languages such as PowerShell, Python, KQL, or SPL.
- Relevant certifications such as Security+, CySA+, GCIH, GCIA, or equivalent cybersecurity certifications.