Job Description: Senior Security Architect
Experience: 8–10 Years
Work Location: Hyderabad, India – Work From Office
Employment Type: Full-Time
Shift: 5:30 PM – 2:30 AM IST
Position Overview
We are seeking an experienced Senior Security Architect with 8–10 years of hands-on experience in cybersecurity operations, security monitoring, threat detection, incident investigation, and response.
The ideal candidate will have strong technical expertise in identifying, analyzing, and responding to security incidents, investigating suspicious activities, analyzing security alerts, and supporting vulnerability remediation. This role focuses on day-to-day security operations and incident response rather than enterprise security architecture, governance, or people management.
Key Responsibilities
1. Security Monitoring & Threat Detection
Monitor security alerts, events, and suspicious activities across enterprise systems, networks, endpoints, and cloud environments.
Analyze security events and identify potential threats, malicious activities, and indicators of compromise (IOCs).
Investigate alerts generated by SIEM, EDR, and other security monitoring tools.
Perform log analysis and correlate security events across multiple sources to identify potential incidents.
Identify patterns of suspicious behavior and recommend appropriate remediation actions.
2. Security Incident Response
Investigate, triage, contain, and support the remediation of cybersecurity incidents.
Respond to incidents involving malware, phishing, unauthorized access, compromised accounts, endpoint threats, and suspicious network activity.
Perform root-cause analysis and document incident findings, timelines, and corrective actions.
Collect and analyze relevant logs and security evidence to support investigations.
Coordinate with infrastructure, network, application, and IT support teams to resolve incidents.
Support incident recovery and post-incident reviews to help prevent recurrence.
3. SIEM, EDR & Security Tools
Work hands-on with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or similar tools.
Use endpoint detection and response (EDR) solutions such as Microsoft Defender for Endpoint, CrowdStrike, or similar platforms.
Investigate alerts using endpoint telemetry, authentication logs, network logs, and cloud security events.
Develop or fine-tune detection rules, alert thresholds, and correlation logic to improve threat detection.
Use security dashboards, queries, and investigation tools to identify and analyze potential threats.
4. Threat Hunting & Vulnerability Management
Perform proactive threat hunting to identify suspicious activities that may not trigger standard security alerts.
Analyze indicators of compromise, threat intelligence feeds, and emerging attack techniques.
Support vulnerability identification, prioritization, remediation tracking, and validation.
Assist in investigating security weaknesses and recommend practical mitigation measures.
Apply knowledge of common attack techniques, including those described in the MITRE ATT&CK framework.
5. Security Operations & Documentation
Follow established security incident response procedures, escalation processes, and service-level agreements (SLAs).
Maintain accurate incident records, investigation notes, evidence, and remediation documentation.
Prepare incident summaries and operational reports for relevant technical stakeholders.
Collaborate with SOC, infrastructure, IAM, network, and application teams to strengthen day-to-day security operations.
Participate in continuous improvement of security monitoring, incident handling, and response processes.