SecOps Engineer / Security Operations / SOC Engineer

About Infra360

Infra360 is a Managed Cloud Service Provider helping businesses build, secure and operate their cloud and technology environments across Cloud, DevOps, SRE, Security, FinOps and Managed Services .

We are building our Security Operations and MDR capabilities and are looking for a hands-on SecOps Engineer to join the team.

About the Role

As a SecOps Engineer, you will be responsible for security monitoring, alert investigation, threat hunting, detection engineering and incident response across customer environments.

This is not a traditional alert-monitoring role . We are looking for someone who can investigate security events, understand attacker behavior, identify the root cause, improve detections and support effective response.

You will work across SIEM, EDR/XDR, cloud, identity, endpoint and network security telemetry .

Key Responsibilities

1. Security Monitoring & Alert Investigation

• •Monitor and investigate security alerts across customer environments.
• •Perform alert triage and determine severity and business impact.
• •Correlate events across endpoint, identity, network and cloud sources.
• •Investigate suspicious activity and identify false positives.
• •Maintain accurate incident timelines and investigation documentation.
• •Work within defined security processes and customer SLAs.

2. SIEM / XDR Operations

• •Work with SIEM/XDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Wazuh, Splunk, Elastic, CrowdStrike, SentinelOne, Google SecOps or similar.
• •Analyze logs and security telemetry.
• •Develop and tune detection and correlation rules.
• •Monitor log-source health and identify visibility gaps.
• •Improve alert quality and detection coverage.

3. Incident Response

Investigate and support response to incidents including:

• •Malware and ransomware
• •Account compromise
• •Phishing and business email compromise
• •Credential attacks
• •Privilege escalation
• •Lateral movement
• •Suspicious PowerShell/scripts
• •Command-and-control activity
• •Cloud security incidents
• •Data-exfiltration activity

The engineer should be able to understand what happened, how it happened, what is affected and what needs to be done next .

4. Threat Hunting

Conduct proactive threat hunting using:

• •MITRE ATT&CK
• •IOCs and TTPs
• •Suspicious processes
• •Authentication anomalies
• •PowerShell/script activity
• •C2 indicators
• •Credential abuse
• •Cloud activity

Identify threats that may not have been detected through existing alerts.

5. Detection Engineering

• •Develop and improve SIEM detection rules.
• •Create and tune correlation rules.
• •Develop behavioral and IOC-based detections.
• •Map detections to MITRE ATT&CK .
• •Identify detection gaps and improve coverage.
• •Convert incident learnings into new detection use cases.
• •Knowledge of Sigma is preferred.

6. EDR/XDR Investigation

• •Analyze processes, process trees, files, hashes and network connections.
• •Investigate endpoint behavior and persistence mechanisms.
• •Support endpoint isolation and containment.
• •Coordinate remediation with the Security & IT Operations team.
• •Validate endpoint security after remediation.

7. Cloud Security Monitoring

Investigate security events across AWS, Azure and GCP .

Exposure to technologies such as CloudTrail, GuardDuty, Security Hub, IAM, WAF, Microsoft Defender and cloud audit logs is preferred.

The role focuses on security monitoring and investigation , while cloud infrastructure ownership remains with DevOps/SRE.

8. Security Automation

Automate repetitive SOC activities using Python, PowerShell, APIs, SIEM automation or SOAR platforms .

Examples include IOC enrichment, reputation checks, automated ticket creation, alert enrichment and response actions.

9. Threat Intelligence & Vulnerability Analysis

• •Enrich investigations using threat intelligence.
• •Analyze IPs, domains, hashes and malware indicators.
• •Track relevant CVEs and exploitation activity.
• •Support risk-based vulnerability prioritization.
• •Use threat intelligence to improve detections and investigations.

What We're Looking For

Must Have:

• •3–7 years of experience in SOC, SecOps, MDR, Incident Response or Cybersecurity .
• •Strong hands-on SIEM experience.
• •Experience with EDR/XDR platforms.
• •Experience investigating security incidents.
• •Strong networking fundamentals.
• •Good Windows and Linux security knowledge.
• •Understanding of IAM and authentication.
• •Understanding of common attack techniques.
• •Incident-response experience.
• •Good understanding of MITRE ATT&CK .
• •Strong analytical and troubleshooting skills.

Good to Have:

• •MDR/MSSP experience.
• •Threat hunting experience.
• •Detection engineering.
• •Sigma/YARA knowledge.
• •Python or scripting.
• •AWS/Azure/GCP security experience.
• •Kubernetes/container security exposure.
• •SOAR experience.
• •Experience handling multiple customers or tenants.

What Success Looks Like

In this role, success means being able to detect, investigate and respond to security threats effectively , while continuously improving Infra360's MDR capabilities.

You will contribute to better detection coverage, faster response, fewer false positives, stronger threat hunting and more effective security operations across customer environments.