SOC Engineer 3

Job detailsApplication formSOC Engineer - 3Detection Engineering, Incident Leadership & Operational ExcellenceLocation: Bangalore (Work From Office)Reports to: CISOCashfree Payments operates mission-critical payment and API infrastructure under RBI andPCI-DSS oversight. Our environment processes high-volume financial transactions anddemands high-fidelity detection, rapid response, and operational resilience.We are building an automation-driven SOC designed to scale beyond traditional monitoringmodels.Role SummaryThe SOC Engineer - 3 is a senior, hands-on technical expert pivotal in accelerating the defensive posture and operational maturity of the Cashfree Payments SOC. This role moves beyond traditional monitoring, focusing instead on Detection Engineering, Incident ResponseLeadership, and operational scaling within our high-volume, regulated Fintech environment.We are looking for a system-thinker and builder who can autonomously architect scalable, automation-driven security solutions.Key ResponsibilitiesDetection and Threat Engineering● Architect, develop, implement, and continually tune detection rules and correlation logic across SIEM and EDR platforms.● Proactively identify and remediate detection gaps, mapping coverage to the MITREATT&CK framework and leveraging threat intelligence, with a special focus on cloud (AWS), containerized (Kubernetes), and payment systems.● Implement advanced contextual alerting and enrichment strategies to drastically reduce false positive rates and combat alert fatigue.● Conduct proactive, hypothesis-driven hunting exercises across diverse telemetry sources (cloud, network, endpoint) to uncover covert threats.Incident Response Leadership & Handling● Function as the primary technical lead for high-severity and complex security incidents, driving effective containment, eradication, and recovery strategies.● Execute in-depth log analysis, digital forensics triage, and timeline reconstruction to determine the root cause and scope of compromise.● Translate findings and lessons learned from incidents into immediate, measurable improvements in detection and prevention mechanisms.● Ensure meticulous documentation of all incidents, including technical steps, post-incident reviews, and executive summaries.SOC Operational Maturity & Automation● Design, develop, and maintain automation playbooks using SOAR platforms to streamline repetitive tasks, triage, and incident response workflows.● Utilize strong scripting skills (e.g. Python) to engineer custom tools and automation solutions, reducing manual effort and increasing response consistency.● Establish and refine Standard Operating Procedures (SOPs) and investigation playbooks, ensuring they are current, effective, and adopted across the team.Performance & Team Enablement● Take full ownership of critical SOC metrics, including Mean Time to Detect (MTTD),Mean Time to Respond (MTTR), and False Positive Rate. Drive measurable improvement quarter over quarter.● Mentor and coach SOC team, elevating their investigative, analytical, and tooling skills.● Plan and execute periodic simulation exercises (e.g., tabletop exercises, purple team engagements) to test and validate SOC readiness and playbooks.Required Qualifications and ExpertiseTechnical Foundation● B.Tech. in Computer Science, Electrical, or Computer Engineering or equivalent practical experience.● 7+ years of hands-on experience in a dedicated Security Operations Center (SOC), Incident Response, or Detection Engineering role.● Expert-level proficiency in SIEM platforms (e.g., Splunk, Elastic, Sentinel) including advanced rule creation, custom parsing, and dashboard development.● Demonstrated strong scripting skills in Python for security automation and data manipulation.● Excellent understanding of TCP/IP, common network protocols, and the function of security appliances (Firewalls, IDS/IPS, Proxies).Soft Skills & Leadership● Proven ability to operate independently, set priorities, and drive complex projects from concept to completion.● Exceptional analytical and problem-solving skills for complex, multi-stage security incidents.● Strong verbal and written communication skills for both technical and executive audiences.● Experience working in a PCI-DSS or RBI-regulated environment is highly desirable.What Excellence Looks Like● Significant reduction in alert fatigue● Improved detection coverage and signal accuracy● Faster, more consistent incident response● Clear improvements in SOC KPIs over time● Audit evidence readily available without reactive effort● SOC processes become automation-driven and scalableApply for this positionAutofill from resumeSave time by uploading your resume. (Only PDF or DOCX format supported)Upload filePersonal InformationFirst name*Last name*Email*Phone🇺🇸+1ProfileEducationAddExperienceAddResume*Drag and drop files or click to uploadSupported files: .pdf & .docx, up to 20 MBCover LetterDrag and drop files or click to uploadSupported files: .pdf & .docx, up to 20 MBNotice period Notice period *Select an optionApply for this positionJob detailsApplication form