About the Role
Reward360 Global Services (R360) operates a banking loyalty and rewards platform integrated with major Indian and international banks, including HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. As R360 stands up a dedicated inhouse Security Operations Centre (SOC), the Permanent SOC Analyst will be a frontline defender for production environments serving these regulated banking clients, delivering 24x7 detection, triage, and incident response across our EDR/XDR stack, while maintaining strict compliance with PCI DSS v4.0.1, the RBI Cyber Security Framework, and the DPDP Act 2023.
Key Responsibilities
1. 24x7 Detection & Monitoring
▪ Monitor CrowdStrike Falcon, SentinelOne , PIM,PAM, and DAM Singularity consoles for endpoint, cloud workload, and identity-based threat detections across production and UAT estates.
▪ Maintain client-segmented visibility and SLA adherence for HDFC, ICICI, and Kotak-linked environments in line with each bank's InfoSec SLA and contractual security addenda.
2. Triage, Investigation & Escalation
▪ Perform L1/L2 alert triage and investigation, mapping detections to MITRE ATT&CK tactics/techniques.
▪ Tune detection rules (custom IOAs in CrowdStrike, Deep Visibility / STAR rules in SentinelOne) to reduce false positives without eroding coverage.
▪ Escalate confirmed incidents per the SOC escalation matrix, with clear severity classification and business-impact framing.
3. Incident Response
▪ Execute containment, eradication, and recovery actions using EDR host-isolation and remediation capability.
▪ Preserve chain-of-custody and forensic integrity for evidence supporting internal investigations and, where required, regulator/bank-facing reporting. Support incident timelines aligned to RBI's cyber-incident reporting mandate and CERT-In reporting obligations.
4. Threat Hunting & Detection Engineering
▪ Run hypothesis-driven threat hunts across endpoint telemetry, prioritizing BFSI-targeted TTPs (banking trojans, ATM/POS malware families, phishing-to-RAT chains, credential-harvesting campaigns).
▪ Correlate EDR telemetry with SIEM, AWS WAF, CloudTrail, and application logs to reconstruct crossenvironment attack chains.
5. Compliance, Audit & Change Support
▪ Provide InfoSec sign-off inputs for change requests (PCCB) impacting SOC-monitored assets, where applicable.
▪ Support PCI DSS QSA assessments, ISO 27001 audits, and bank-specific annual vendor security reviews with SOC tooling evidence (alert logs, detection coverage reports, response-time metrics).
6. Documentation & Mentorship
▪ Maintain shift handover notes, SOC playbooks, and runbooks; contribute to continuous improvement of detection use cases.
▪ Mentor SOC interns on triage methodology, tool usage, and escalation discipline.
Required Qualifications
▪ Bachelor's degree in computer science, IT, or a related field (or equivalent practical experience).
▪ 2–3 years of hands-on SOC / blue-team experience, ideally within BFSI, fintech, or another regulated environment.
▪ Working expertise with at least one EDR/XDR/ platform, incident responder; CrowdStrike Falcon and/or SentinelOne Singularity strongly preferred.
▪ Solid grounding in the MITRE ATT&CK framework, cyber kill chain analysis, and common BFSI threat-actor TTPs.
▪ Familiarity with SIEM platforms (Splunk / QRadar / Microsoft Sentinel / ELK) for cross-source log correlation.
▪ Working knowledge of PCI DSS v4.0.1 (particularly Requirements 10, 11, and 12), the RBI Cyber Security Framework, and DPDP Act 2023 fundamentals.
▪ Comfort with Windows and Linux internals, core network protocols (TCP/IP, DNS, HTTP/S), and common attack vectors.
▪ Scripting/automation ability (Python or PowerShell) for detection engineering or SOAR playbook development is a strong plus.
▪ Familiarity with building internal SOC tools and Agentic automation
Preferred Certifications
▪ CompTIA Security+ / CySA+
▪ CrowdStrike Certified Falcon Administrator (CCFA) or Responder (CCFR) ▪ CEH (Certified Ethical Hacker)
▪ CSA ▪ OSDA
Soft Skills
▪ Willingness and ability to work rotational shifts, including nights and weekends, as part of 24x7 SOC coverage.
▪ Strong written communication for incident reports, shift handovers, and periodic client-facing summaries.
▪ Composure under pressure, able to prioritise correctly during multi-alert or major-incident scenarios.