SecOps Engineer / Security Operations / SOC Engineer (Gurugram)

About Infra360 Infra360 is a Managed Cloud Service Provider helping businesses build, secure and operate their cloud and technology environments across Cloud, DevOps, SRE, Security, FinOps and Managed Services . We are building our Security Operations and MDR capabilities and are looking for a hands-on SecOps Engineer to join the team. About the Role As a SecOps Engineer, you will be responsible for security monitoring, alert investigation, threat hunting, detection engineering and incident response across customer environments. This is not a traditional alert-monitoring role . We are looking for someone who can investigate security events, understand attacker behavior, identify the root cause, improve detections and support effective response. You will work across SIEM, EDR/XDR, cloud, identity, endpoint and network security telemetry . Key Responsibilities 1. Security Monitoring Alert Investigation - Monitor and investigate security alerts across customer environments. - Perform alert triage and determine severity and business impact. - Correlate events across endpoint, identity, network and cloud sources. - Investigate suspicious activity and identify false positives. - Maintain accurate incident timelines and investigation documentation. - Work within defined security processes and customer SLAs. 2. SIEM / XDR Operations - Work with SIEM/XDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Wazuh, Splunk, Elastic, CrowdStrike, SentinelOne, Google SecOps or similar. - Analyze logs and security telemetry. - Develop and tune detection and correlation rules. - Monitor log-source health and identify visibility gaps. - Improve alert quality and detection coverage. 3. Incident Response Investigate and support response to incidents including: - Malware and ransomware - Account compromise - Phishing and business email compromise - Credential attacks - Privilege escalation - Lateral movement - Suspicious PowerShell/scripts - Command-and-control activity - Cloud security incidents - Data-exfiltration activity The engineer should be able to understand what happened, how it happened, what is affected and what needs to be done next . 4. Threat Hunting Conduct proactive threat hunting using: - MITRE ATTCK - IOCs and TTPs - Suspicious processes - Authentication anomalies - PowerShell/script activity - C2 indicators - Credential abuse - Cloud activity Identify threats that may not have been detected through existing alerts. 5. Detection Engineering - Develop and improve SIEM detection rules. - Create and tune correlation rules. - Develop behavioral and IOC-based detections. - Map detections to MITRE ATTCK . - Identify detection gaps and improve coverage. - Convert incident learnings into current detection use cases. - Knowledge of Sigma is preferred. 6. EDR/XDR Investigation - Analyze processes, process trees, files, hashes and network connections. - Investigate endpoint behavior and persistence mechanisms. - Support endpoint isolation and containment. - Coordinate remediation with the Security IT Operations team. - Validate endpoint security after remediation. 7. Cloud Security Monitoring Investigate security events across AWS, Azure and GCP . Exposure to technologies such as CloudTrail, GuardDuty, Security Hub, IAM, WAF, Microsoft Defender and cloud audit logs is preferred. The role focuses on security monitoring and investigation , while cloud infrastructure ownership remains with DevOps/SRE. 8. Security Automation Automate repetitive SOC activities using Python, PowerShell, APIs, SIEM automation or SOAR platforms . Examples include IOC enrichment, reputation checks, automated ticket creation, alert enrichment and response actions. 9. Threat Intelligence Vulnerability Analysis - Enrich investigations using threat intelligence. - Analyze IPs, domains, hashes and malware indicators. - Track relevant CVEs and exploitation activity. - Support risk-based vulnerability prioritization. - Use threat intelligence to improve detections and investigations. What Were Looking For Must Have: - 3-7 years of experience in SOC, SecOps, MDR, Incident Response or Cybersecurity . - Strong hands-on SIEM experience. - Experience with EDR/XDR platforms. - Experience investigating security incidents. - Strong networking fundamentals. - Positive Windows and Linux security knowledge. - Understanding of IAM and authentication. - Understanding of common attack techniques. - Incident-response experience. - Good understanding of MITRE ATTCK . - Strong analytical and troubleshooting skills. Good to Have: - MDR/MSSP experience. - Threat hunting experience. - Detection engineering. - Sigma/YARA knowledge. - Python or scripting. - AWS/Azure/GCP security experience. - Kubernetes/container security exposure. - SOAR experience. - Experience handling multiple customers or tenants. What Success Looks Like In this role, success means being able to detect, investigate and respond to .