Key Responsibilities

1. Secure and continuously harden the AWS environment — IAM least-privilege, network controls (security groups, NACLs), encryption (KMS), and comprehensive logging
2. Own cloud security posture management: detect and remediate misconfigurations and risky changes using AWS-native tooling (GuardDuty, Security Hub, Config, CloudTrail) alongside CrowdStrike Falcon Cloud Security
3. Detect, investigate, and respond to threats against cloud workloads, identities, and the control plane — including cloud-specific techniques such as credential abuse, privilege escalation, and data exfiltration
4. Partner with infrastructure teams to embed security into cloud architecture and deployments
5. Monitor SIEM dashboards and the CrowdStrike Falcon console to detect security incidents, reliably distinguishing routine network noise from genuine threats
6. Use CrowdStrike Process Execution Trees to trace alerts to root cause, analysing parent/child process relationships (e.g., why Excel spawned PowerShell) to confirm malicious behaviour
7. Move beyond signature matching by using Indicators of Attack (IOAs) to detect “Living off the Land” and fileless attacks, mapping activity to the MITRE ATT&CK framework
8. Own incidents across the full NIST incident-response lifecycle — detection and analysis, containment, eradication, recovery, and lessons learned — using Real Time Response (RTR) for live investigation and remediation
9. Classify incidents by severity, isolate compromised hosts, and drive verified threats through to closure

Ideal Candidate

1. B.E. / B.Tech / M.Tech in Information Technology, Computer Science, or Cybersecurity — or equivalent practical experience
2. Minimum 3 years of hands-on cybersecurity experience spanning threat detection, incident response, and cloud security.
3. Hands-on scripting and automation experience (Python preferred) and comfort working with security and cloud platform APIs
4. Strong analytical thinking — the ability to “follow the breadcrumbs” through an investigation — and concise, accurate incident communication
5. Proven hands-on experience securing AWS environments.
6. AWS Certified Security – Specialty strongly preferred; AWS Certified Solutions Architect – Associate or Cloud
7. Hands-on Wazuh experience deploying and administering a multi-node Manager/Indexer stack