Team Lead Threat Monitoring & Analysis

Job Title: Team Lead – Threat Monitoring & Analysis

Department: Information Security / Cyber Defense

Reports To: Chief Information Security Officer (CISO) / Head of
Information Security

Location: Bhubaneswar, Odisha (On-site)

Employment Type: Full-Time

​

Position
Overview

We are seeking an
experienced Team Lead – Threat Monitoring & Analysis to be based in Bhubaneswar,
Odisha, to establish and lead a dedicated defensive security monitoring
function. Operating independently from our Site Reliability Engineering (SRE)
and infrastructure teams, this team focuses exclusively on continuous network
security monitoring, threat detection engineering, and deep log/behavioral
analysis.

In this role, you will
direct a team of security analysts, establish our detection and threat-hunting
capabilities, oversee out-of-band telemetry ingestion, and serve as the
technical escalation authority for security incidents. You will manage
monitoring infrastructure across our Linux workloads, microservices, and
network channels, ensuring proactive detection and scoping of adversaries
before operational impact occurs.

Prerequisite
Experience (Mandatory Baseline)

Prior to applying,
candidates must demonstrate proven, hands-on experience in the following
specific scenarios:

1.     Root-Level
Incident & Compromise Handling: Demonstrated track record of investigating, scoping, and analyzing live Linux
root-level security compromises, persistence mechanisms
(cron/systemd/ld.so.preload), or kernel space anomalies.

2.     Out-of-Band
Telemetry Architecture: Practical
experience setting up or managing isolated, read-only out-of-band security
ingestion pipelines and SIEM/WORM storage decoupled from primary production
administrative access.

3.     SRE &
Operations Boundary Enforcement: Proven
experience defining clear technical boundaries, escalation SLAs, and read-only
separation of duties between security analysis teams and SRE/DevOps operational
teams.

4.     Custom Detection
& Parser Engineering: Direct
experience building, testing, and deploying custom threat signatures (Sigma,
YARA, Suricata/Zeek rules) and system call telemetry (auditd, eBPF/Falco)
rather than relying solely on out-of-the-box vendor configurations.

Key
Responsibilities

1.
Technical Leadership & Detection Engineering

●      Design, implement,
and lead the Threat Monitoring & Analysis strategy targeting Linux kernel
integrity, network telemetry, and microservices security.

●      Map detection logic
and alert coverage against established frameworks (e.g., MITRE ATT&CK),
focusing on privilege escalation, lateral movement, persistence mechanisms, and
exfiltration vectors.

●      Establish alert
quality control standards to maintain a low false-positive rate and prevent
analyst burnout across SIEM, NIDS/HIDS, and endpoint detection platforms.

●      Lead proactive
threat-hunting exercises using low-level system telemetry (auditd, eBPF,
network flow logs, and system call traces).

2. Incident
Triage, Escalation & Handoff

●      Serve as the senior
escalation point to validate, scope, and classify security anomalies and
suspected breaches.

●      Author clear,
evidence-backed incident escalation packages (timelines, IOCs, affected assets,
and recommended containment steps) for execution by SRE/DevOps teams.

●      Lead
security-focused Root Cause Analysis (RCA) retrospectives following security
events to refine detection signatures and address visibility gaps.

3. Team
Management & Operational Governance

●      Manage day-to-day
operations, shift handovers, and performance metrics (MTTD, MTTE, Detection
Precision) for the threat analysis team.

●      Maintain
step-by-step incident investigation playbooks and detection runbooks.

●      Enforce strict
operational boundaries: ensure threat monitoring tools operate read-only
out-of-band without direct production execution rights.

●      Oversee continuous
monitoring of privileged access, SSH usage, and infrastructure deployment
pipelines to detect unauthorized administrative actions.

Requirements

●      Experience: Minimum of 7+ years in Incident Response,
Security Operations (SOC), Threat Hunting, or Threat Detection Engineering,
with at least 2+ years leading technical security teams.

●      Location &
Work Setup: Based in or willing to
relocate to Bhubaneswar, Odisha.

●      Linux Deep-Dive: Advanced knowledge of Linux operating system internals,
security architectures (auditd, eBPF, PAM, /etc integrity, process tracing),
and root-level threat vectors (rootkits, library preloading, dynamic linker
hijacking).

●      Network &
Traffic Analysis: Strong proficiency
with deep packet inspection (DPI), network flow analysis (Zeek/Suricata/Snort),
and identifying command-and-control (C2) dynamic DNS, reverse shells, or
exfiltration channels.

●      Detection &
SIEM Tools: Extensive experience
configuring SIEMs, log ingestion pipelines, YARA rules, and Sigma detection
logic.

●      Scripting &
Analytics: Hands-on proficiency in
Python, Bash, or Go for custom log parsing, API integrations, and threat
intelligence ingestion.

Preferred
Qualifications

●      Relevant industry
certifications: GIAC (GCIH, GCIA, GNFA), CISSP, Certified Threat Intelligence
Analyst (CTIA), or equivalent practical credentials.

●      Experience setting
up write-once/read-many (WORM) or out-of-band security log pipelines isolated
from primary production networks.

●      Familiarity with
microservices, container security (Kubernetes/Docker runtime monitoring), and
cloud telemetry.

Key
Operational Metrics & KPIs

●      Mean Time to
Detect (MTTD): Minimize time elapsed
between adversary activity and initial validation.

●      Detection
Precision: Maintain an actionable
alert-to-noise ratio exceeding 80%.

●      MITRE ATT&CK
Coverage: Expand detection rule coverage
across high-risk post-exploitation tactics year-over-year.