IT Security Engineer

IT Security Engineer

Location: Chennai, India | Experience: 2–4 years

About the Role

Rootquotient is hiring its first dedicated security team member to own day-to-day security operations and strengthen our existing EDR/XDR setup. You’ll investigate threats, keep endpoints secure, improve cloud and identity security, and maintain audit readiness while helping engineering teams ship securely.

You’ll also explore practical AI-assisted and agentic workflows for alert investigation, evidence collection, and routine security checks, with human oversight for critical actions.

Reporting to [IT/Engineering Head], you’ll work closely with engineering, IT, external auditors, and our security vendors. Your scope and level of ownership will reflect your experience, as outlined below.

Role Expectations

• •Independently manage SentinelOne EDR operations across approximately 150 macOS endpoints, ensuring endpoint compliance.
• •Tune SentinelOne policies with vendor support, create custom S1QL detection rules, and manage exceptions to reduce false positives without weakening threat detection.
• •Investigate security alerts and reconstruct incident timelines using SentinelOne Deep Visibility, Entra sign-in logs, and AWS CloudTrail.
• •Lead first-level response to credential compromises, account takeovers, and malware, coordinating device isolation, session revocation, and credential rotation with IT and engineering.
• •Audit and harden IAM permissions across 160 AWS accounts, enforcing least-privilege access.
• •Review KMS key policies, inspect VPC flow logs, and monitor Secrets Manager for security gaps and suspicious activity.
• •Monitor S3 public access and dangling Route53 records, tracking remediation to closure.
• •Manage Cloudflare WAF rules and rate limits using real traffic patterns to block attacks while preserving legitimate access.
• •Connect Cloudflare WAF, GuardDuty, and Entra logs into centralized monitoring and unified alerting.
• •Support engineering security reviews by explaining findings, severity, remediation, and delivery impact without unnecessarily blocking releases.
• •Support dependency scanning, secret scanning, and PR-level security checks to identify vulnerable dependencies, hardcoded secrets, missing encryption, and exposed APIs before release.
• •Define SOC 2 Type 2 and ISO audit evidence requirements, collection cadence, gap tracking, and escalation paths.
• •Prepare structured audit evidence packages and explain how the evidence demonstrates control implementation to leadership and external auditors.
• •Maintain security operating procedures, incident response checklists, and CIS/NIST control documentation.
• •Build automations for repeatable security checks, GuardDuty-to-Lambda alert routing, ticket enrichment, guided remediation, daily attendance reporting, and evidence collection.
• •Help define required compliance evidence, collection frequency, ownership, gap reporting, and escalation paths.
• •Support early security automation use cases such as alert enrichment, ticket enrichment, incident summaries, evidence preparation, and guided remediation checklists.
• •Contribute to product/security automation discussions by validating practical security workflows and guardrails.
• •Work closely with vendors, IT, engineering, delivery teams, leadership, and customer audit teams to improve security practices continuously.

What You Will Do

• •Manage endpoint security across macOS and Windows devices, including EDR policies, encryption, hardening, access controls, patch posture, and endpoint compliance.
• •Operate and tune EDR/XDR and DLP tools such as SentinelOne, CrowdStrike, Check Point, Microsoft Defender, and related security products.
• •Monitor and investigate EDR, DLP, and endpoint alerts, reduce false positives, and escalate suspicious activities, policy violations, and security exceptions as per the defined incident management process.
• •Support incident response activities, including alert triage, endpoint isolation, evidence collection, ticket creation, escalation, and closure tracking.
• •Track endpoint and vulnerability gaps, including patch status, endpoint health, device compliance, and security exceptions, and coordinate remediation to closure.
• •Maintain security policies, procedures, checklists, and standards aligned with NIST, ISO 27001, SOC 2, CIS Controls, and customer security expectations.
• •Support internal and customer audits by collecting evidence, preparing control documentation, and tracking gap closure, and help define evidence, check frequency, and ownership for automated compliance evidence collection.
• •Assist in XDR/SIEM implementation by helping connect endpoint, identity, cloud, and application signals into a centralized monitoring model.
• •Act as a security SME for project and product teams, supporting dependency scanning, secret scanning, code security checks, configuration review, PR-level security review, and release-readiness checks.
• •Explain security findings clearly to engineering, project teams, vendors, leadership, and customer audit teams, including risk, severity, recommended fix, and release impact.
• •Explore AI-assisted security workflows such as alert summarization, evidence preparation, ticket enrichment, and guided remediation, and help define guardrails for AI-assisted or agentic security workflows.
• •Provide security-related IT support for device setup, software installation, access issues, endpoint agent health, encryption, VPN, and compliance checks.

Future Security Responsibilities

• •XDR/SIEM adoption and centralized security monitoring.
• •Automated compliance evidence collection for audits and customer security reviews.
• •AI-assisted alert triage to improve speed, consistency, and quality of investigations.
• •Continuous compliance monitoring for endpoint, access, cloud, and security controls.
• •DevSecOps security checks including dependency scanning, secret scanning, SAST/SCA, container scanning, and IaC scanning.
• •Release security readiness for project and product teams.
• •Controlled remediation workflows with clear ownership, approvals, evidence, and closure tracking.
• •Product-facing security automation exposure where relevant, especially around security workflows, policy checks, evidence collection, and AI-assisted security operations.

Your Impact and Growth in Year One

• •Every company laptop has a healthy EDR agent, encryption enabled, and up-to-date patches.
• •Alerts are triaged consistently, using AI-assisted investigation where useful, with documented response actions and tested recovery procedures.
• •Audit evidence stays ready, and compliance findings are addressed within agreed timelines.
• •Security gaps have a named owner, target closure date, and clear escalation path.
• •Engineering teams involve security early and resolve critical findings before release.
• •Real ownership as the first dedicated security hire, with established infrastructure to improve.
• •Hands-on experience across AWS, SentinelOne, Entra ID, M365, incident response, compliance, and AI-assisted security operations.
• •Opportunities to build agentic workflows for alert enrichment, evidence collection, and guided remediation, with human approval for critical actions.
• •Close collaboration with engineering, product, IT, leadership, and external auditors to protect company data and help teams ship securely.
• •Autonomy to make decisions and grow through deeper expertise, new security initiatives, and future team-building opportunities.