Threat hunting
Jobrapido
- Местоположение
- Bengaluru, Karnataka, India
- Опубликовано
- 5 окт. 2026 г.
Перед откликом проверьте на сайте работодателя, открыта ли вакансия, и ознакомьтесь с полными условиями.
Описание вакансии
Интерфейс на русском языке. Названия и описания вакансий сохраняются на языке публикации работодателя, в том числе на английском.
Company: TCS
Skill: Threat Hunting / Modeling
Experience: 6 to 15 Years
Location: Bengaluru
Interview Mode: Face to Face (Walkin) Interview
Date: 29th Aug 2026(Saturday)
Job description:
Proactive Threat Hunting
Conduct hypothesis-driven and data-driven threat hunting across endpoints, networks, cloud, and identity systems. Identify anomalous behaviors, TTPs, and indicators of compromise using MITRE ATT&CK and threat intel sources. Perform deep-dive investigation into suspicious activities, lateral movement, privilege escalation, and persistence techniques. Analysis & Detection Engineering
Analyze logs, telemetry, and events from SIEM, EDR, XDR, NDR, Firewall, and Cloud security tools. Develop new detection rules, signatures, and behavioral analytics to improve SOC detection capabilities. Validate, tune, and optimize detection logic to reduce false positives. Threat Intelligence Integration
Consume threat intel reports, IOCs, malware analysis feeds, and emerging threat trends. Translate threat intel into actionable hunting queries, playbooks, and detection rules. Incident Response Support
Collaborate with SOC Analysts and Incident Response teams during investigations. Provide recommendations for containment, remediation, and hardening. Perform root-cause analysis on identified threats. Reporting & Documentation
Prepare detailed hunt reports, findings, and risk insights for leadership. Document new hunting methodologies, playbooks, and detection logic. Required Skills and Qualifications
Experience in Threat Hunting, SOC, Incident Response, or Cyber Defense. Strong understanding of: MITRE ATT&CK Framework. Windows/Linux internals. Network protocols (TCP/IP, DNS, etc.). Cloud platforms (AWS, Azure, GCP). Hands-on experience with SIEM/EDR/XDR tools such as: Splunk, Sentinel, QRadar, ELK. CrowdStrike, Defender ATP, Tanium, Carbon Black, Palo Alto Cortex. Ability to write complex queries using: KQL, SQL, SPL, YARA, Sigma rules. Experience analyzing malicious files, scripts, and techniques used by APT groups. Strong analytical, investigative, and problemsolving skills.