Threat Detection Analyst
Exabeam Threat Detection Analyst
Exabeam is a leader in intelligence and automation that powers security operations for the world's smartest companies. As a global cybersecurity innovator, Exabeam provides industry-proven, security-focused, and flexible solutions for faster, more accurate threat detection, investigation, and response (TDIR). Exabeam and LogRhythm have merged.
About the role
We are hiring a Threat Detection Analyst to join our team in Pune. This is a hands-on analysis role for someone who wants to spend their day in the telemetry: triaging alerts, chasing down suspicious behaviour, and turning what they find into better detections.
You will sit alongside the engineers who build our detection content, which means your findings have a short path to the product. When you spot a noisy rule or a coverage gap, you will be the one who raises it and helps fix it.
This is a good role for an analyst who is early in their career but serious about the craft, and who wants to work on detection quality rather than only closing tickets.
About the role
We are hiring a Threat Detection Analyst to join our team in Pune. This is a hands-on analysis role for someone who wants to spend their day in the telemetry: triaging alerts, chasing down suspicious behaviour, and turning what they find into better detections.
You will sit alongside the engineers who build our detection content, which means your findings have a short path to the product. When you spot a noisy rule or a coverage gap, you will be the one who raises it and helps fix it.
This is a good role for an analyst who is early in their career but serious about the craft, and who wants to work on detection quality rather than only closing tickets.
- Monitor and triage security alerts raised by the Exabeam and LogRhythm platforms, escalating what needs deeper investigation.
- Investigate suspicious user and entity behaviour, and document findings clearly for engineering and customer-facing teams.
- Test and validate new detection content before release, reporting false positives with the evidence needed to tune them.
- Maintain and improve triage runbooks so investigations are repeatable across the team.
- Track emerging threats and adversary techniques, and flag gaps in current detection coverage.
- Work with detection engineers to refine correlation rules and behavioural analytics models.
- Support escalations that call for hands-on analysis of security telemetry.
Essential
- Experience in a security operations, threat detection, or incident response role, or a strong foundation from a security-focused degree or certification pathway.
- Working knowledge of SIEM tooling, and the ability to write and refine search queries against security telemetry.
- Understanding of common attack techniques across endpoint, network, identity, and cloud, and familiarity with MITRE ATT&CK.
- Ability to read logs from operating systems, firewalls, and identity providers and reason about what actually happened.
- Clear written communication, and the discipline to document an investigation so a colleague can follow it.
- Willingness to work as part of a rota that supports colleagues and customers across time zones.
Desirable
- Scripting ability in Python or a similar language for automating repetitive analysis.
- Exposure to user and entity behaviour analytics (UEBA) or anomaly-based detection.
- Familiarity with cloud provider security logging, such as AWS CloudTrail, Azure Activity Logs, or GCP audit logs.
- Certifications such as CompTIA Security+, GCIH, or GCIA.