Sr IT Cyber Defense Analyst

Senior IT Cyber Defense Analyst (Shift Lead) AI-Enabled Security Operations | 24/7 SOC Location: Remote – Pune/Baroda, India Department: IT Cybersecurity – Security Operations Center (SOC) Reports To: SOC Manager Work Schedule: 24/7 rotational shifts About the Role We are seeking an experienced Senior IT Cyber Defense Analyst (Shift Lead) to lead day-to-day SOC operations, oversee security investigations, coordinate incident response, and mentor SOC analysts. The ideal candidate will bring strong SIEM/EDR expertise, advanced threat investigation skills, and hands-on experience using AI/LLM tools and automation to improve SOC efficiency and detection capabilities. Key Responsibilities - Lead SOC shift operations, prioritize alerts, manage escalations, and ensure timely handovers and SLA adherence. - Investigate complex incidents involving phishing, malware, ransomware, compromised accounts, endpoint threats, and suspicious network activity. - Conduct threat hunting, correlate security telemetry, and map attacker behavior to the MITRE ATT&CK framework. - Develop, optimize, and troubleshoot SIEM queries, analytics rules, and detection use cases using Microsoft Sentinel and KQL. - Use approved AI/LLM tools for alert triage, investigation assistance, threat intelligence enrichment, KQL development, incident reporting, and workflow automation; independently validate AI-generated outputs. - Automate repetitive SOC tasks using Python, PowerShell, APIs, or SOAR capabilities. - Mentor analysts, improve investigation quality, reduce false positives, and maintain accurate incident documentation and audit-ready evidence. - Coordinate with Incident Response, IT, Endpoint, Network, and Cloud teams to support containment, remediation, and recovery. Required Skills and Qualifications - Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent practical experience. - 5+ years of experience in SOC, cyber defense, or incident response, including shift leadership, incident coordination, or analyst mentoring. - Strong hands-on experience with SIEM, EDR/XDR, incident investigation, and threat detection. - Proficiency in Microsoft Sentinel and KQL; experience with Microsoft Defender, CrowdStrike, or similar security platforms. - Strong understanding of networking, Windows/Linux, identity security, email threats, and MITRE ATT&CK. - Mandatory practical AI/LLM proficiency, including prompt engineering, AI-assisted investigations, validation of AI-generated queries/scripts, and awareness of hallucinations, prompt injection, and data privacy risks. - Scripting or automation experience using Python, PowerShell, APIs, or SOAR tools. - Strong analytical, communication, decision-making, and team leadership skills; willingness to work in a 24/7 rotational shift environment. Preferred Qualifications - Certifications such as Microsoft SC-200, CompTIA CySA+, GCIH, or relevant SIEM/EDR vendor certifications. - Experience in proactive threat hunting, detection engineering, cloud security, and SOC process improvement. What Success Looks Like - Effective shift leadership and timely, high-quality incident handling. - Improved detection coverage, investigation efficiency, and reduced false positives. - Practical adoption of AI and automation to reduce repetitive work while maintaining security, accuracy, and human oversight. - Strong analyst development, documentation, and operational consistency. Originally posted on Himalayas