Cybersecurity Engineer (L3)

Role Overview

The L3 Cybersecurity Engineer serves as a senior technical authority within the security operations team, owning P1/P2 incident response, post-incident analysis, detection engineering, and L2 capability development. This is a leadership-oriented, high-ownership role operating with full autonomy across client environments.

YOU ARE!

• You are a senior cybersecurity professional with deep SOC expertise and strong hands-on experience in leading complex security operations.
• You are capable of independently managing high-severity security incidents, including P1/P2 incidents, from initial triage and investigation to containment, resolution, root cause analysis, and stakeholder communication.
• You have strong practical experience in SIEM, EDR, incident response, threat detection, alert tuning, and detection engineering.
• You are skilled in identifying root causes, deriving actionable insights, and recommending preventive measures to reduce recurrence and improve security posture.
• You are capable of designing and improving response playbooks, automation workflows, and SOC processes to enhance operational efficiency at scale.
• You are technically strong, proactive, and able to mentor L2 analysts while driving continuous improvement in detection quality, response maturity, and overall SOC effectiveness.

Key Responsibilities

• Lead P1 P2 incident response end-to-end across client environments
• Conduct root cause analysis formal post-mortems for major incidents
• Drive detection rule tuning sustained false positive reduction
• Design implement automation, response playbooks runbooks
• Lead proactive threat hunting across client environments
• Mentor train L2 analysts structured coaching knowledge transfer
• Act as engineering liaison between SOC/NSOC and security engineering teams
• Author and maintain SOPs, process documentation operational standards
• Manage shift handovers ensure continuity, escalation readiness log integrity

Required Skills Experience

• 8 10 years SOC / cybersecurity operations (L3)
• CrowdStrike Falcon Sentinel One hands-on EDR
• SIEM platforms Adlumin or equivalent
• Full incident response lifecycle ownership
• MITRE ATTCK framework working knowledge
• Log analysis, threat detection incident handling
• Windows / Linux networking fundamentals

Tooling Platform Management

• CrowdStrike Falcon health alert pipeline
• Sentinel One telemetry response workflows
• Adlumin SIEM log management ingestion
• Monitor tool health data pipeline continuity
• roubleshoot integration telemetry gaps

Compliance Governance

• ISO/IEC 27001 control implementation alignment
• Support audits, risk assessments reporting
• Maintain incident documentation, SOPs playbooks

Education

• B.Tech / B.E. / BCA / B.Sc (IT, CS, Electronics)

Good to Have

• ISO/IEC 27001 audit or implementation exposure
• Cloud environments Azure / AWS
• Certifications: Security+, CEH, CySA+ or equivalent

Soft Skills

• Analytical, structured problem-solving approach
• Clear written verbal communication
• Independent and effective in on-site environments
• Proactive, ownership-driven with low supervision

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.