SOC Analyst

We are looking for a skilled and proactive SOC Analyst to join our Security Operations team. In this role, you will be responsible for monitoring, detecting, investigating, and responding to security threats across cloud, endpoint, network, identity, email, and SaaS environments.

You will work across multiple security platforms to ensure timely identification, investigation, containment, and remediation of security incidents. You will also contribute to improving detection engineering, threat intelligence, incident response processes, and overall security operations capabilities.

The ideal candidate has hands-on experience with SIEM and EDR platforms, strong analytical and investigation skills, a good understanding of common cyberattack techniques, and the ability to effectively collaborate with IT, Infrastructure, DevOps, Engineering, and Compliance teams.

• Monitor and investigate security alerts across SIEM, EDR, email security, WAF, cloud security, and threat intelligence platforms.

• Triage and analyze alerts from multiple sources, including cloud infrastructure logs, identity providers, source code repositories, endpoint telemetry, and web application firewalls.

• Investigate security incidents involving:

  • Phishing and impersonation attempts

  • Malware infections

  • Credential compromise

  • Suspicious login and authentication activity

  • Data exfiltration

  • Network scanning and reconnaissance

  • Public exposure of sensitive resources

  • Compromised accounts and systems

• Determine the severity, scope, impact, and potential root cause of security incidents.

• Escalate confirmed incidents based on defined severity and response procedures.

• Coordinate containment, remediation, and recovery activities with IT, Infrastructure, DevOps, Engineering, and Compliance teams.

• Maintain accurate incident documentation and timelines.

• Monitor and manage security detection rules across SIEM platforms.

• Fine-tune alert rules to reduce false positives and improve detection accuracy.

• Build and maintain custom SIEM dashboards for centralized monitoring and proactive threat detection.

• Develop correlation rules and detection logic based on emerging threats and attack patterns.

• Enrich security logs with contextual information such as office IP addresses, employee details, asset information, cloud account mappings, and identity context.

• Develop and optimize queries for bulk log retrieval, security investigations, threat hunting, and operational reporting.

• Identify gaps in existing detection coverage and recommend improvements.

• Develop and maintain incident response playbooks for common security scenarios.

• Monitor threat intelligence platforms for emerging internal and external security threats.

• Investigate intelligence related to:

  • Credential breaches

  • Compromised systems

  • Malware

  • Exposed credentials or secrets

  • Source code repository exposure

  • API-related threats

  • Malicious infrastructure

• Correlate external threat intelligence with internal security telemetry.

• Perform basic threat hunting across endpoint, cloud, network, identity, and application data.

• Map observed threats and attack techniques to relevant security frameworks where applicable.

• Continuously improve detection capabilities based on threat intelligence and emerging attack patterns.

• Monitor external sources for malicious domains, phishing websites, brand impersonation, and fraudulent applications.

• Identify potential brand abuse and digital threats targeting the organization or its customers.

• Coordinate with relevant internal teams and external service providers for takedown activities.

• Optimize threat intelligence and brand monitoring rules to reduce noise and improve threat visibility.

• Track and document identified external threats through resolution.

• Monitor EDR platforms for endpoint threats and suspicious behavioral activity.

• Investigate endpoint alerts involving malware, unauthorized access, suspicious processes, credential theft, and other malicious activity.

• Monitor email security platforms for phishing, malicious attachments, suspicious links, and impersonation attempts.

• Monitor WAF activity and identify malicious IPs, attack patterns, scanning activity, and application-layer threats.

• Recommend appropriate detection and blocking rules based on observed attack patterns.

• Identify and escalate shadow IT and unauthorized SaaS usage.

• Support implementation of controls to reduce data leakage through unapproved tools and services.

• Monitor cloud security alerts and activity across AWS, GCP, Azure, or equivalent cloud environments.

• Analyze cloud logs and telemetry from services such as AWS GuardDuty, CloudTrail, and VPC Flow Logs.

• Investigate suspicious cloud authentication, access, network, and resource activity.

• Identify publicly exposed resources, unusual access patterns, privilege escalation, and potential cloud compromise.

• Work with Cloud, Infrastructure, and DevOps teams to contain and remediate cloud security incidents.

• Create clear and detailed incident reports documenting the alert, investigation, findings, impact, and remediation actions.

• Maintain SOC runbooks, incident response procedures, and investigation playbooks.

• Track incidents and security alerts through ticketing and workflow systems.

• Maintain accurate records of security events, investigation evidence, and remediation activities.

• Prepare periodic SOC metrics and security operations reports.

• Identify opportunities to improve SOC processes, detection capabilities, and response times.

• Recommend improvements to security monitoring, alerting, logging, and investigation workflows.

• Participate in security operations reviews and post-incident analysis.

• Stay updated on emerging attack techniques, vulnerabilities, threat actors, and security technologies.

• Contribute to building a proactive and scalable security operations capability.

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical field.

• Relevant cybersecurity certifications are an added advantage.

• 2–4 years of experience in a Security Operations Center, Security Monitoring, Incident Response, Cybersecurity Operations, or related role.

• Hands-on experience investigating security alerts and security incidents.

• Experience working across cloud, endpoint, email, network, identity, and application security telemetry.

• Experience with security ticketing and incident management workflows.

• Strong analytical, investigation, documentation, and problem-solving skills.

• Hands-on experience with at least one SIEM platform such as Splunk, Microsoft Sentinel, Coralogix, QRadar, or equivalent.

• Familiarity with EDR solutions such as SentinelOne, CrowdStrike, Microsoft Defender for Endpoint, or equivalent.

• Understanding of cloud security concepts across AWS, GCP, or Azure.

• Knowledge of common attack techniques, including:

  • Phishing

  • Malware

  • Credential compromise

  • Data exfiltration

  • Lateral movement

  • Privilege escalation

  • Reconnaissance and network scanning

• Experience analyzing security logs and correlating events across multiple sources.

• Basic scripting or query-language skills for security investigations and detection rule creation.

• Strong written communication and documentation skills.

• Exposure to brand monitoring and digital risk protection platforms.

• Experience with external threat monitoring and credential breach investigations.

• Familiarity with threat intelligence feeds and threat enrichment platforms.

• Understanding of threat hunting methodologies.

• Familiarity with the MITRE ATT&CK framework for attack classification, detection mapping, and threat hunting.

• Understanding of common cybersecurity frameworks and incident response methodologies.

• Experience with KQL, SPL, Lucene, or equivalent log query languages.

• Experience creating SIEM detection rules and correlation searches.

• Ability to develop queries for investigation, threat hunting, and security reporting.

• Knowledge of DLP solutions such as Zscaler, Netskope, or equivalent.

• Familiarity with SaaS Security Posture Management (SSPM).

• Understanding of data leakage risks and shadow IT.

• Exposure to network security monitoring tools such as Zeek, Suricata IDS, or equivalent.

• Understanding of network traffic analysis, DNS, HTTP/S, TCP/IP, and common network attack patterns.

• Understanding of email security concepts and protocols.

• Familiarity with DMARC, DKIM, and SPF.

• Experience investigating phishing and business email compromise scenarios.

Any relevant cybersecurity certification is an advantage, including:

• CompTIA Security+

• CEH

• Microsoft SC-200

• BTL1

• CSA

• Other relevant SOC, security operations, or incident response certifications

• SIEM: Splunk, Microsoft Sentinel, Coralogix, QRadar

• EDR: CrowdStrike, SentinelOne, Microsoft Defender for Endpoint

• Cloud Security: AWS GuardDuty, CloudTrail, VPC Flow Logs, GCP, Azure

• Query Languages: SPL, KQL, Lucene, SQL

• Threat Intelligence: Threat Intelligence Platforms, External Threat Monitoring

• Network Security: Zeek, Suricata IDS, WAF

• Email Security: Email Security Gateways, DMARC, DKIM, SPF

• Data Protection: Zscaler, Netskope, DLP/SSPM solutions

• Ticketing & Collaboration: Jira, ServiceNow, or equivalent platforms

• Frameworks: MITRE ATT&CK

• Security alert triage and investigation efficiency

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

• Incident escalation and containment

• SIEM alert quality and false-positive reduction

• Detection coverage and rule effectiveness

• Threat intelligence and external threat monitoring

• Incident documentation and response SLA adherence

• Security playbook and runbook maturity

• SOC process improvement initiatives

• Opportunity to work on security operations within a fast-growing FinTech environment.

• Exposure to cloud, endpoint, SaaS, application, identity, and network security challenges at scale.

• Hands-on experience with modern SIEM, EDR, threat intelligence, and cloud security technologies.

• Opportunity to build and improve detection engineering and incident response capabilities.

• Work closely with experienced Engineering, Infrastructure, DevOps, Compliance, and Security teams.

• Continuous learning and exposure to evolving cybersecurity threats and technologies.

• Collaborative and growth-focused work environment.

• Competitive compensation and benefits.

Position: SOC Analyst - Security Operations

Employment Type: Full-Time

Experience Level: Mid-Level (2–4 Years)

Location: Bengaluru

Work Model: On-site

Krazybee is committed to maintaining a transparent, fair, and secure recruitment process. We have become aware of fraudulent individuals and entities falsely claiming to represent Krazybee and offering fake employment opportunities.

Please note that Krazybee never asks candidates to pay any money for registration, training, certifications, security deposits, or any other purpose at any stage of the recruitment process. Candidates are advised to verify the sender's email address before responding to any recruitment-related communication. Krazybee does not conduct recruitment through unofficial email addresses or request payments.

If you receive a suspicious job offer, interview invitation, or recruitment-related communication claiming to be from Krazybee, do not make any payment or share sensitive personal or financial information. We encourage you to verify the authenticity of the communication through the official careers page or appropriate company channels.

Disclaimer: Krazybee shall not be responsible for any loss, damage, or claims arising from fraudulent job offers or recruitment communications made by unauthorized individuals or entities falsely representing the company. Candidates should exercise due diligence and verify the authenticity of all recruitment-related communications before taking any action.

This job description is intended to outline the general nature and key responsibilities of the position. It is not intended to be an exhaustive list of all duties, responsibilities, or qualifications associated with the role. The responsibilities and qualifications described may be subject to change, and other duties may be assigned as needed.

By applying for this position, you acknowledge and agree that any personal data you provide may be used for recruitment and employment purposes. The data collected will be stored and processed in accordance with our privacy policy and applicable data protection laws. Your information will only be shared with relevant internal stakeholders and will not be disclosed to third parties without your consent.