SENIOR SUPPORT ENGINEER - Cyber Security

Role overview

SENIOR SUPPORT ENGINEER - Cyber Security at Happiest Minds

Responsibilities

• Lead complex, multi-stage investigations across endpoint, identity, network, cloud and SaaS telemetry, including advanced malware analysis, credential-compromise and lateral-movement investigations, and adversary tradecraft reconstruction. ?
• Create and maintain SOC playbook, runbook and knowledge-based library: define structure and standards, author content for complex scenarios, and ensure content stays current with tooling and threat changes. ?
• Provide seniors on-call escalation coverage for major incidents.

Required qualifications

• Strong experience in cloud security monitoring and response across at least one major provider (AWS, Azure or GCP), including identity, control-plane and workload telemetry. ?

Employment details

• Location: Noida

About the employer

• About You ? 8+ years in security operations, incident response, detection engineering or an equivalent blue-team role, including several years leading complex incidents end to end and acting as a technical escalation point for other analysts. ?

Additional role details

• Primary Responsibilities ?
• Act as incident lead for investigating and handling high-severity and complex security incidents end to end: direct scoping, containment, eradication and recovery, coordinate technical and business stakeholders, and own the root-cause analysis also provide details for post-incident review. ?
• Works on detection engineering lifecycle: define detection strategy aligned to MITRE ATT&CK and the organisation's threat model, identify and recommend new detection logic across SIEM, XDR, EDR and SOAR, and measure coverage, precision and time-to-detect. ?
• Works on hypothesis-driven threat hunts based on threat intelligence, emerging TTPs and gaps in detection coverage; convert findings into new detections, playbooks and control recommendations. ?
• Lead Tier 2 SOC operations, including shift priorities, case load and escalation flow, ensuring SLAs and quality standards are consistently met. ?
• Identify, design and recommend process improvements across the SOC, measuring and reporting their impact. ?
• Contribute to and help implement the multi-year security operations strategy, including detection coverage roadmap, telemetry strategy, automation targets and capability maturity. ?
• Translate security findings into risk-based recommendations for security engineering, IT and business stakeholders, and influence control and architecture decisions across teams. ?
• Mentor and develop Tier 1 and Tier 2 analysts through structured coaching, investigation walkthroughs and technical training; contribute to hiring and capability planning. ?
• Participate the SOC in cross-functional forums and with global security teams to ensure a cohesive, consistent approach to security operations. ?
• Bachelor's degree in Information Systems, Cybersecurity or a related field, or equivalent experience. ?
• Advanced certifications such as GCIA, GCIH, GCFA, GCDA, GNFA, GREM, OSCP, Microsoft SC-200 or equivalent are highly regarded. ?
• Deep, hands-on expertise with SIEM (advanced KQL, SPL or equivalent, including detection authoring and performance tuning) and EDR platforms (live response, forensic artefact collection, process-tree and memory analysis); experience with SOAR design and automation. ?
• Expert knowledge of Windows, Linux, Active Directory and Entra ID attack techniques and the telemetry needed to detect them; able to reconstruct an intrusion from raw logs without a playbook. ?
• Proficiency in Python or PowerShell for automation, data analysis and tooling integration. ?
• Deep working knowledge of MITRE ATT&CK, the incident response lifecycle, malware analysis and phishing investigation, and experience mapping detection coverage against adversary TTPs. ?
• Track record of defining standards, processes and playbooks that others operate against, and of improving them based on evidence. ?
• Demonstrated ability to mentor analysts and raise the technical bar of a team. ?
• Sound, independent judgement under pressure; comfortable making and owning decisions during live incidents with incomplete information. ?
• Clear, structured technical writing, including incident reports, RCAs and briefings for senior technical and non-technical audiences. ?
• Strong influencing and collaboration skills; able to partner with engineering, IT and business teams locally and globally to drive change without direct authority.