- Support, coordinate and improve the Endpoint protection service (specifically on alerts & events, footprint monitoring and incident oversight and escalation management)

- Fine tune the alerts and thresholds defined on the different IT Security Tools.

- Improve and define SIEM use cases, log management policies and sources follow-up, alerts and thresholds, in order to leverage them within real time event monitoring activities or for future exploitation and usage.

- Support incident investigations by providing deep technical expertise in attacker behaviors, telemetry analysis, and log correlation.

- Monitor, conclude, maintain and improve different detection services as part of cyber security regular operations (CTI, threat hunting, leaked credentials, look-a-like domains, phishing alert)

- Support from a security standpoint the business divestment and acquisitions, so that new entities comply with Holcims standards, and risks are minimized in business to be sold.

- Analyze and tune existing alerts and detection logic to reduce noise and improve operational efficiency.

- Maintain and improve the Holcims knowledge base, to ensure continuous monitoring and deployment of cyber security controls and mechanisms take place.

- Work closely with the Protect and Respond cyber security teams, to ensure standards and configurations in place are well understood, by ensuring the right detection capabilities are in place in case of a significant breach, and by providing all required support to the Respond area in case of a crisis situation.

Position Requirements :

- University degree in the field of computer science, engineering, or a related field to support IT and cyber security.

- Being in possession of at least one cyber security certification from ISACA, ISC2, Sans Institute or equivalent.

- 5+ years of experience in Cybersecurity, with a strong focus on detection engineering, security operations, or threat detection.

- Candidates with a Cybersecurity Master or working on a SOC would be in advantage.

- Hands-on experience working with Google SecOps SIEM/ SOAR platform.

- Experience developing detections using SentinelOne EDR/XDR platform.

- Strong understanding of attacker techniques and adversary behaviors, including familiarity with the MITRE ATT&CK framework.

- Experience analyzing endpoint, network, cloud, and identity telemetry.

- Experience with AWS and GCP cloud providers security monitoring methodology and tools.

- Experience using incident handling methodologies.

- Understanding of adversarial behavior, malware basics, system and network events and administration.

- Experience with scripting or programming (e.g., Python, PowerShell, Bash) for automation and detection development.

- High level of ethics, values and personal integrity, and the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity.

- Excellent written, oral and interpersonal communication skills in English.

- Effective in a variety of communication settings (one-on-one, small and large groups, or among diverse styles and position levels).

- Attentively listens to others.

- Be a team player.

- Extensive experience working in a team-oriented and collaborative environment. Preference to have worked in a global environment and with virtual teams.

Other Information :

- Value inclusion within your day to day responsibilities by respecting others perspectives/ convictions, engaging others opinions, creating a safe environment where people, ideas and opinions are valued within the team / internal customers and external partners.

- Respect and take into consideration diversity by valuing different world views, challenges and cultures that represent all walks of life and all backgrounds.

- Is sensitive to how people, cultures and organizations function. Deals comfortably with organizational politics. Steer through the organizational maze to get things done.

- Demonstrates positive thinking mindset, consistently identifying highlights.

- Shows a can-do attitude in good and bad times and acts as a role model in terms of ethics and self-awareness.

- Fluent written and spoken English with good command on inter personal and business communication.

Work Location :

- Navi Mumbai, India

- Hybrid working model as per company policy