ICC - 安全运营分析师 - 网络防御 | IST 时区
ICC - Security Operations Analyst - Cyber Defense | IST Timezone
地点：印度，以远程为主
职位类型：全职合同
工作时长：6个月，可能延长
语言要求：英语流利
行业：网络安全 / 云服务 / 企业安全
关于该职位
Pragmatike 正代表一家大型国际组织招聘一名安全运营分析师，加入全球24/7网络安全运营中心。
你将与不同地区的网络安全专家合作，监控、检测、调查并响应云、终端、网络和企业环境中的网络安全威胁。
这是一个需要经验丰富的安全专业人士参与的实战型SOC岗位，要求在安全警报优先级排序、日志分析、SIEM/EDR平台和事件响应方面具备扎实技能。
你将负责
- 在SIEM、EDR、微软安全工具和云平台上监控、优先级排序并调查安全警报。
- 分析来自Windows、Linux、数据库、应用程序、Web服务器、防火墙和NIDS/HIDS的主机和网络日志。
- 调查可疑活动并确定潜在根本原因。
- 支持事件响应、修复和恢复工作。
- 确定适当的升级路径，并与相关网络安全团队协调。
- 与事件响应专家合作调查和管理威胁。
- 识别提升检测质量及减少误报的机会。
- 支持安全监控优化和白名单调优。
- 准备技术报告、摘要和安全发现。
- 维护SOC文档、流程和知识库内容。
- 参与流程改进和运营质量提升项目。
我们寻找的人选
- 5年以上相关IT/网络安全经验。
- 具有安全警报优先级排序和事件调查的实际经验。
- 具有SIEM和EDR平台的工作经验。
- 在Windows/Linux和企业基础设施上具有强大的日志分析能力。
- 对微软安全技术有深入了解。
- 具有Azure、AWS和/或GCP的经验。
- 具有至少一个SIEM平台（如Microsoft Sentinel、Splunk、QRadar、ArcSight或ELK）的经验。
- 具有至少一个EDR解决方案（如Microsoft Defender for Endpoint或CrowdStrike）的经验。
- 了解电子邮件安全、网络监控和事件响应。
- 精通Linux、macOS和Windows系统。
- 英语流利，具备出色的书面和口头沟通能力。
加分项
- Ti
查看英文原文
Location: India, Remote-First
Employment: Full-Time Contract
Duration: 6 months, with potential extension
Language: Fluent English required
Industry: Cybersecurity / Cloud / Enterprise Security
ABOUT THE OPPORTUNITY
Pragmatike is recruiting on behalf of a major international organization for a Security Operations Analyst to join a global 24/7 Cybersecurity Operations Centre.
You’ll work with cybersecurity specialists across different regions to monitor, detect, investigate, and respond to cyber threats across cloud, endpoint, network, and enterprise environments.
This is a hands-on SOC role for an experienced security professional with strong skills across security alert triage, log analysis, SIEM/EDR platforms, and incident response.
WHAT YOU’LL DO
- Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security tools, and cloud platforms.
- Analyze host and network logs from Windows, Linux, databases, applications, web servers, firewalls, and NIDS/HIDS.
- Investigate suspicious activity and identify potential root causes.
- Support incident response, remediation, and recovery activities.
- Determine appropriate escalation paths and coordinate with relevant cybersecurity teams.
- Work with Incident Response specialists to investigate and manage threats.
- Identify opportunities to improve detection quality and reduce false positives.
- Support security monitoring optimization and whitelist tuning.
- Prepare technical reports, summaries, and security findings.
- Maintain SOC documentation, procedures, and knowledge-base content.
- Contribute to process improvements and operational quality initiatives.
WHAT WE’RE LOOKING FOR
- 5+ years of relevant IT/cybersecurity experience.
- Hands-on experience with security alert triage and incident investigation.
- Experience working with SIEM and EDR platforms.
- Strong log analysis skills across Windows/Linux and enterprise infrastructure.
- Deep knowledge of Microsoft Security technologies.
- Experience with Azure, AWS, and/or GCP.
- Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, or ELK.
- Experience with at least one EDR solution such as Microsoft Defender for Endpoint or CrowdStrike.
- Knowledge of email security, network monitoring, and incident response.
- Strong Linux, macOS, and Windows knowledge.
- Fluent English with excellent written and verbal communication skills.
NICE TO HAVE
- Tier-1/Tier-2 Incident Response experience.
- AWS security monitoring experience across IaaS, PaaS, or SaaS environments.
- Scripting experience with Python, PowerShell, Bash, Ruby, or similar.
- Certifications such as SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE.
- Experience working in a global SOC or distributed cybersecurity team.
WHY JOIN
- Join a global 24/7 Security Operations Centre protecting international organizations.
- Work across a broad cybersecurity stack spanning SIEM, EDR, cloud, network, and endpoint security.
- Collaborate with security specialists across different regions and technical disciplines.
- Gain hands-on exposure to real-world threat detection and incident response.
- Work remotely while contributing to a globally distributed cybersecurity operation.
Pragmatike is committed to a fair, transparent, and inclusive recruitment process. We do not discriminate based on age, disability, gender, gender identity or expression, marital or civil partner status, pregnancy or maternity, race, religion or belief, sex, or sexual orientation.
In accordance with GDPR, your personal data will be processed lawfully, fairly, and securely and used solely for recruitment purposes, including sharing it with our client(s) for employment consideration.