ICC - Security Operations Analyst - Cyber Defense | IST Timezone

Location: India, Remote-First
Employment: Full-Time Contract
Duration: 6 months, with potential extension
Language: Fluent English required
Industry: Cybersecurity / Cloud / Enterprise Security

About the Opportunity

Pragmatike is recruiting on behalf of a major international organization for a Security Operations Analyst to join a global 24/7 Cybersecurity Operations Centre.

You’ll work with cybersecurity specialists across different regions to monitor, detect, investigate, and respond to cyber threats across cloud, endpoint, network, and enterprise environments.

This is a hands-on SOC role for an experienced security professional with strong skills across security alert triage, log analysis, SIEM/EDR platforms, and incident response.

What You’ll Do

• Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security tools, and cloud platforms.
• Analyze host and network logs from Windows, Linux, databases, applications, web servers, firewalls, and NIDS/HIDS.
• Investigate suspicious activity and identify potential root causes.
• Support incident response, remediation, and recovery activities.
• Determine appropriate escalation paths and coordinate with relevant cybersecurity teams.
• Work with Incident Response specialists to investigate and manage threats.
• Identify opportunities to improve detection quality and reduce false positives.
• Support security monitoring optimization and whitelist tuning.
• Prepare technical reports, summaries, and security findings.
• Maintain SOC documentation, procedures, and knowledge-base content.
• Contribute to process improvements and operational quality initiatives.

What We’re Looking For

• 5+ years of relevant IT/cybersecurity experience.
• Hands-on experience with security alert triage and incident investigation.
• Experience working with SIEM and EDR platforms.
• Strong log analysis skills across Windows/Linux and enterprise infrastructure.
• Deep knowledge of Microsoft Security technologies.
• Experience with Azure, AWS, and/or GCP.
• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, or ELK.
• Experience with at least one EDR solution such as Microsoft Defender for Endpoint or CrowdStrike.
• Knowledge of email security, network monitoring, and incident response.
• Strong Linux, macOS, and Windows knowledge.
• Fluent English with excellent written and verbal communication skills.

Nice to Have

• Tier-1/Tier-2 Incident Response experience.
• AWS security monitoring experience across IaaS, PaaS, or SaaS environments.
• Scripting experience with Python, PowerShell, Bash, Ruby, or similar.
• Certifications such as SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE.
• Experience working in a global SOC or distributed cybersecurity team.

Why Join

• Join a global 24/7 Security Operations Centre protecting international organizations.
• Work across a broad cybersecurity stack spanning SIEM, EDR, cloud, network, and endpoint security.
• Collaborate with security specialists across different regions and technical disciplines.
• Gain hands-on exposure to real-world threat detection and incident response.
• Work remotely while contributing to a globally distributed cybersecurity operation.