Re:Sources India Gurgaon IT

Key Responsibilities

Security Monitoring & Alert Triage

• Monitor, analyze, and triage security alerts and events from SIEM, EDR, IDS/IPS, firewalls, and other security solutions in a timely and efficient manner.

Incident Detection & Initial Analysis

• Perform initial investigation and analysis of detected security incidents to determine scope, impact, and root cause.
• Conduct investigations across various environments, including:
  • Windows and Linux operating systems
  • Networks and security devices
  • Databases
  • EDR consoles
  • Cloud infrastructure (AWS, Azure, GCP)

Threat Hunting & Proactive Detection

• Proactively hunt for threats, anomalies, and Indicators of Compromise (IOCs) within the environment.
• Utilize advanced analytics, threat intelligence feeds, and security tools to identify and uncover stealthy attacks.

Use Case Creation & Fine-Tuning

• Develop, implement, and optimize security monitoring use cases.
• Create and fine-tune correlation rules, alerts, and dashboards within SIEM and other security platforms.
• Enhance detection capabilities while minimizing false positives.

Incident Coordination & Escalation

• Serve as a primary point of contact for incident escalations.
• Coordinate with Incident Response (IR) teams and key stakeholders during active security incidents.
• Provide detailed findings, analysis, and recommendations.

Reporting & Compliance Support

• Generate comprehensive security reports, metrics, and incident summaries.
• Support management reporting, audit requirements, and compliance initiatives.
• Contribute to overall security posture improvements.

Documentation & Knowledge Sharing

• Create and maintain:
  • Security procedures
  • Runbooks
  • Incident handling guides
  • Knowledge base articles
• Promote knowledge sharing and ensure consistent operational practices.

Cross-Functional Collaboration

• Collaborate effectively with:
  • IT Operations
  • Development Teams
  • Network Engineering
  • Security Compliance Teams
• Drive improvements in organizational security hygiene and resilience.

Continuous Learning & Threat Intelligence

• Stay current with:
  • Emerging cybersecurity threats
  • Attack techniques and trends
  • MITRE ATT&CK Framework
  • Industry best practices
  • Security technologies
• Pursue continuous learning through certifications, research, and threat intelligence consumption.

Skills & Qualifications

Experience

• 3–5 years of experience in a Security Operations Center (SOC), Blue Team, or similar cybersecurity role.

Technical Skills

• Strong understanding of:
  • Security principles
  • Common attack vectors
  • Incident response methodologies
• Proficiency with SIEM platforms, including:
  • Log analysis
  • Rule creation
  • Dashboard development
• Hands-on experience with EDR solutions for endpoint investigation and response.
• Experience monitoring and securing:
  • Windows and Linux operating systems
  • Firewalls and IDS/IPS solutions
  • Databases
  • Cloud platforms (AWS, Azure, GCP)

Preferred Technical Knowledge

• Network protocols (TCP/IP)
• Cybersecurity frameworks:
  • NIST
  • MITRE ATT&CK
• Scripting languages:
  • Python
  • PowerShell

Professional Competencies

• Excellent analytical, problem-solving, and decision-making skills.
• Strong written and verbal communication skills.
• Ability to work independently and collaboratively in a fast-paced environment.
• Innovative approach to problem-solving and solution development.
• Strong ownership and accountability for issue resolution.
• Self-motivated, proactive, and adaptable working style.
• Ability to manage multiple tasks and prioritize based on business criticality.
• Experience working effectively with remote teams and stakeholders.
• Strong documentation and knowledge-sharing capabilities.

Education

• Full-Time Bachelor's or Master's Degree in Computer Science, Information Technology, Cybersecurity, or a related field.

Preferred Certifications

• Certified Ethical Hacker (CEH)
• CompTIA Security+
• AWS Security Certification
• Certified Cloud Security Professional (CCSP)
• Systems Security Certified Practitioner (SSCP)