Experience Required
8-12 years in Information Security with minimum 5 years in cloud security and SIEM operations
Cloud Security Management
- Design, implement, and maintain security architectures across Azure and AWS multi-cloud environments
- Lead security assessments, vulnerability management, and penetration testing initiatives
- Architect and enforce security policies, standards, and best practices for cloud infrastructure
- Manage identity and access management (IAM) policies, roles, and permissions across both platforms
- Implement and maintain security monitoring, logging, and SIEM solutions
- Lead incident response activities and conduct root cause analysis for security events
SIEM Operations & Security Monitoring
Design, deploy, and manage enterprise SIEM platforms (Splunk, Azure Sentinel, IBM QRadar, LogRhythm)Develop and optimize correlation rules, alerts, and detection use casesCreate custom parsers and data connectors for log ingestion from multiple sourcesImplement advanced threat hunting and analytics using SPL, KQL, or similar query languagesManage log retention, archival, and compliance requirementsIntegrate SIEM with SOAR platforms for automated incident responseTune alert thresholds to minimize false positives while maintaining detection effectivenessGenerate security metrics, dashboards, and executive-level reportsConduct regular health checks and performance optimization of SIEM infrastructureMajor Security Areas
1. Identity & Access Management (IAM)
Implement least privilege access and role-based access control (RBAC)Manage Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Privileged Access Management (PAM)Configure Azure AD, AWS IAM, Okta, and other identity providersImplement Just-In-Time (JIT) access and Privileged Identity Management (PIM)Conduct access reviews and entitlement management2. Data Security & Encryption
Implement data classification and Data Loss Prevention (DLP) solutionsManage encryption at rest and in transit across all platformsConfigure key management systems (KMS) and Hardware Security Modules (HSM)Implement database security controls and monitoringDesign data masking and tokenization strategies3. Endpoint Security
Deploy and manage EDR / XDR solutions (CrowdStrike, Microsoft Defender, Carbon Black)Implement anti-malware, host-based firewalls, and security agentsManage mobile device management (MDM) and endpoint complianceConfigure application whitelisting and device control policies4. Vulnerability Management
Lead enterprise vulnerability assessment programsManage scanning tools (Qualys, Nessus, Rapid7, Tenable)Prioritize vulnerabilities using CVSS scoring and business contextTrack remediation efforts and report on security postureConduct regular penetration testing and red team exercises5. Threat Intelligence & Hunting
Leverage threat intelligence feeds and platforms (MISP, ThreatConnect, Recorded Future)Conduct proactive threat hunting using MITRE ATT&CK frameworkAnalyze indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs)Develop custom threat detection rules and signaturesParticipate in threat intelligence sharing communities6. Incident Response & Forensics
Lead security incident response following NIST guidelinesConduct digital forensics and malware analysisManage security operations center (SOC) escalationsDevelop and maintain incident response playbooksCoordinate with external stakeholders during breaches7. Cloud Security Posture Management (CSPM)
Implement CSPM tools (Prisma Cloud, CloudGuard, Azure Security Center)Continuously monitor cloud configurations for security risksRemediate misconfigurations and security driftEnforce cloud security baselines and CIS benchmarks8. Compliance & Risk Management
Ensure compliance with ISO 27001, SOC 2, GDPR, HIPAA, PCI-DSS, NIST, FedRAMPConduct security audits and prepare compliance reportsPerform risk assessments and develop risk mitigation strategiesManage security governance frameworksDevelop and maintain security documentation, runbooks, and proceduresRequired Skills & Expertise
Cloud Platforms
Azure : Azure Security Center, Microsoft Defender for Cloud, Azure Sentinel, Azure AD, Azure Policy, Azure Firewall, Application Gateway, NSGs, Azure Monitor, Azure Key Vault, Microsoft Defender for IdentityAWS : AWS Security Hub, GuardDuty, AWS IAM, Security Groups, AWS WAF, CloudTrail, Config, Inspector, Macie, KMS, CloudWatch, Systems Manager, AWS ShieldSIEM & Security Monitoring
SIEM Platforms : Expert-level proficiency in Splunk Enterprise Security, Azure Sentinel (Microsoft Sentinel), IBM QRadar, LogRhythm, Elastic SIEMQuery Languages : SPL (Splunk), KQL (Kusto Query Language), SQL for security analyticsLog Management : Log aggregation, parsing, normalization from diverse sources (Windows, Linux, cloud, network devices, applications)Correlation & Analytics : Creating correlation searches, threat detection rules, behavioral analyticsSOAR Integration : Integration with Security Orchestration and Automated Response platforms (Splunk SOAR, Azure Logic Apps, Palo Alto Cortex XSOAR)Threat Detection : Building use cases for ATT&CK framework, anomaly detection, user behavior analytics (UEBA)Security Tools & Technologies
Vulnerability Management : Qualys, Nessus, Rapid7, Tenable, OpenVASEDR / XDR : CrowdStrike Falcon, Microsoft Defender for Endpoint, Carbon Black, SentinelOneCASB : Microsoft Defender for Cloud Apps, Netskope, ZscalerDLP : Symantec DLP, Microsoft Purview, ForcepointPAM : CyberArk, BeyondTrust, Thycotic Secret ServerAPI Security : Apigee, Kong, AWS API Gateway securitySecurity Frameworks & Standards
NIST Cybersecurity Framework (CSF)NIST SP 800-53, 800-171CIS Benchmarks and ControlsOWASP Top 10 & OWASP ASVSMITRE ATT&CK FrameworkZero Trust Architecture (NIST SP 800-207)Cloud Security Alliance (CSA) Cloud Controls MatrixISO 27001 / 27002PCI-DSS, HIPAA, GDPR, SOC 2Highly Preferred certifications :
Certified Cloud Security Professional (CCSP)GIAC Security Essentials (GSEC) or GIAC Certified Incident Handler (GCIH)Certified Ethical Hacker (CEH) or Offensive Security Certified Professional (OSCP)Certified Kubernetes Security Specialist (CKS)