Arcsight Jobs in Bengaluru

Platform Admin NextGen SIEM Location: Bangalore (Onsite) About ColorTokens At ColorTokens, we re all about helping businesses stay secure and keep running, no matter what cyber chaos hits. Our game-changing Xshield platform stops ransomware and malware from spreading sideways, so companies can keep their critical stuff safe and business uninterrupted. We bring insane visibility into traffic flows between workloads, IoT devices, users basically everything to create super tight security zones that isolate threats fast. We re a Forrester Wave Leader (Q3 2024) for microsegmentation and protect global giants from costly cyber disruptions. Our Culture We love self-starters who bring energy, curiosity, and big ideas. You ll get to own projects, collaborate with passionate teammates, and work on security that actually protects real people from hospitals to cities to entire nations. What You ll Do The Role You ll run and manage our NextGen SIEM platform think Splunk, Sentinel, Exabeam, Stellar Cyber, or similar making sure it s up-to-date, humming smoothly, and packed with the right alerts. Admin & Ops: Install, configure, patch, and keep the SIEM platform running 24/7. Log Boss: Bring in new log sources, troubleshoot ingestion issues, and ensure data is clean and compliant. Rule Maker: Build and tweak detection rules and alerts to catch real threats while cutting down false alarms. Integrate & Automate: Connect SIEM with other security tools and automate incident workflows. Lock It Down: Manage user access, keep the platform secure, and nail compliance requirements. Team Player: Work closely with SOC analysts, threat hunters, and engineers to level up detection and response. Support & Train: Help users get the most from the platform and be the go-to expert when incidents hit. Optimize & Report: Track performance, fix bottlenecks, and share insights to keep the platform sharp. What You Bring Your Skills & Experience 8+ years managing SIEM platforms, especially NextGen ones like Splunk, Sentinel, or Exabeam. Expert in log management, rule creation, and onboarding data from all sorts of sources. Solid scripting skills (Python, PowerShell) to automate and customize workflows. Deep knowledge of log formats (Syslog, JSON, XML), querying languages (KQL, SPL, AQL), and data pipelines. Experience integrating SIEM with EDR, SOAR, NDR, and threat intel platforms. Familiar with security frameworks like MITRE ATT&CK, NIST, or CIS. Bonus points if you know cloud security (AWS, Azure, GCP), machine learning in SIEM, or SOAR tools like Cortex XSOAR or Phantom. Your Credentials Bachelor s degree in Computer Science, InfoSec, or related field (or equivalent experience). Relevant certifications like Splunk Certified Admin, Microsoft Security Operations Analyst, QRadar cert, or CISSP are a major plus. What Success Looks Like Keep SIEM uptime near 100%. Smoothly onboard new log sources and build killer detection use cases. Reduce noise fewer false positives, sharper alerts. Fast, effective fixes when platform issues pop up. Align SIEM capabilities tightly with security and business goals. Qualification : Bachelors degree in Computer Science, InfoSec, or related field (or equivalent experience).

Join Our Team as a Security Operations Analyst Location: Bangalore, India (On-site) Department: Information Security At Cytiva, we are advancing the future of therapeutics from discovery to delivery. As a leading global provider of technology and services that help researchers and pharmaceutical companies develop and manufacture life-saving treatments, our work is integral to shaping the future of healthcare. We are seeking a Security Operations Analyst to join our global Information Security Team in Bangalore. In this key role, you will be at the forefront of protecting our digital assets and infrastructure by monitoring, analyzing, and responding to security incidents. By proactively identifying threats and vulnerabilities, you will help minimize risk and ensure business continuity. What You ll Do Lead Security Incident Response: Conduct advanced security incident analysis and digital forensics to identify and mitigate threats. Lead investigations into malware, network traffic anomalies, and endpoint detection. Provide Expertise: Guide and mentor L1 and L2 SOC analysts, enhancing the quality of security alerts and incident handling. Optimize Security Tools: Collaborate with engineering teams to fine-tune SIEM tools (e.g., Splunk, Microsoft Sentinel, Elastic Security) and other security technologies for improved detection and response. Proactive Threat Hunting: Identify hidden threats within the organization through threat hunting activities, reducing the potential attack surface. Enhance Security Posture: Partner with other IT and security teams to strengthen the overall security posture, ensuring resilient systems and infrastructures. Post-Incident Reporting: Produce detailed incident reports and provide recommendations for security improvements, leading post-incident reviews with cross-functional teams. Who You Are Experience: Minimum of 5+ years in a corporate IT environment, including at least 2 years in an L3 or senior analyst role. Security Knowledge: Deep expertise in security frameworks such as MITRE ATT&CK, NIST, CIS Controls, and ISO 27001. Technical Skills: Hands-on experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar, ArcSight) and EDR/XDR solutions. Vendor certifications are a plus. Incident Response Expertise: Strong background in incident response, threat hunting, and forensic investigations. Cloud Security Knowledge: Familiarity with cloud security platforms (AWS, Azure, Google Cloud) and modern attack techniques. Certifications like OSCP, CEH are advantageous. Additional Skills That Would Be a Plus: Scripting & Automation: Proficiency in scripting (e.g., Python, PowerShell, Bash) to automate security processes and improve SOC workflows. Specialization: Expertise in EDR, SIEM, UBA, DLP, or Data Security. OT Environments: Experience with Operation Technology (OT) environments is an advantage. Innovative Culture: Join a dynamic, global team dedicated to advancing healthcare through technology and innovation. Impactful Work: Your role will directly contribute to the security and integrity of vital technologies used in the life sciences industry. Global Collaboration: Work with cross-functional teams around the world, contributing to an organization's critical security initiatives. Growth Opportunities: Benefit from continuous learning, career development, and the chance to make a tangible impact on both the organization and the industry. Apply now and be part of a team that is dedicated to ensuring the security of life-saving technologies.

Job Role: SIEM Specialist The SIEM Specialist will be responsible for implementing, managing, and optimizing Security Information and Event Management (SIEM) solutions to enhance the organization's security posture. The role involves onboarding new security data sources, collaborating with cross-functional teams, and continuously improving SIEM performance to support proactive threat detection and incident response. Experience and Qualifications: Educational Background: Bachelor s degree in Computer Science, Information Technology, or a related field (preferred). Total Experience: 7 8 years of experience in IT security with a minimum of 3 years in SIEM implementation and security data source onboarding. Experience working in large organizations or global service providers with complex infrastructures. Proficiency in deploying, configuring, and managing SIEM solutions such as Splunk, ArcSight, Chronicle (Google Security Operations), and ELK Stack. Familiarity with Cribl and regex is required. Strong knowledge of log management solutions, log parsing, and normalization techniques. Experience integrating SIEM with various data sources, including firewalls, IDS/IPS, antivirus, and endpoint solutions. Proficiency in scripting languages (e.g., Python, PowerShell) for automating SIEM tasks and data analysis. Understanding of cloud platforms (GCP, AWS, Azure) and cloud databases is desirable. Good grasp of cybersecurity principles, including threat detection, incident response, and vulnerability assessment. Strong knowledge of networking protocols, firewall rules, and network security practices for onboarding and monitoring network traffic. Excellent verbal and written communication skills for collaborating with cross-functional teams and documenting onboarding procedures. Strategic and analytical mindset with outstanding problem-solving skills to navigate complex cybersecurity landscapes. Key Responsibilities: Lead the onboarding process of new data sources into the SIEM platform, ensuring proper data normalization and correlation. Continuously improve SIEM performance, efficiency, and scalability. Maintain detailed documentation of SIEM configurations, onboarding procedures, and incident response playbooks. Collaborate with cross-functional teams to identify security requirements and integrate new security technologies into the SIEM environment. Stay informed about emerging threats, vulnerabilities, and security best practices and incorporate this knowledge into SIEM operations. Ensure that SIEM configurations and operations comply with relevant industry regulations and standards. Qualification : Bachelors degree in Computer Science, Information Technology, or a related field (preferred).

Introduction A career in IBM Consulting is built on long-term client relationships and close collaboration to transform the hybrid cloud and AI landscape for some of the world's most innovative companies. Leveraging IBM's robust technology platforms, including Red Hat, and a strategic partner ecosystem, you'll accelerate impact and deliver meaningful change for clients. This role emphasizes curiosity, creativity, and a culture of evolution, fostering career growth and unique opportunities to make a groundbreaking impact. Your Role and Responsibilities As a SOC Analyst, you will monitor Information Security events using SIEM tools and contribute to safeguarding IT infrastructure by responding to potential threats. Your role involves: Researching security threats and providing insights into new and existing risks. Recommending and improving SOC security processes, procedures, policies, incident management, and vulnerability management. Evaluating, recommending, and resolving issues related to security solutions and assessing the security of new IT systems. Staying updated with emerging security threats and regulatory requirements. Working in a 24x7 Security Operation Centre (SOC) environment to ensure constant vigilance and response to threats. Required Education Bachelor s Degree Preferred Education Bachelor s Degree Required Technical and Professional Expertise 1+ year of experience in SIEM platforms such as QRadar, ArcSight, or Splunk. B.E./B.Tech/MCA/M.Sc. in Computer Science or IT with CEH Certification. Proven ability to monitor security events across SOC channels (SIEM, tickets, email, phone) and escalate based on severity. Expertise in threat modeling, use case development, and policy reviews for security monitoring tools. Preferred Technical and Professional Experience Self-motivated and ambitious with the ability to work independently toward goals. Creative and adaptable with excellent time management skills. Strong interpersonal skills, contributing effectively to team efforts. Join IBM Consulting, where your technical expertise and creative thinking will contribute to a safer digital landscape and help shape the future of cybersecurity. Qualification : Bachelor's Degree

Our Exciting Opportunity: We are looking for a Security Engineer to manage, track, and support security-related activities within our organization, ensuring the continuous availability and performance of services as per Service Level Agreements (SLA). This role will involve incident management, security tool integration, process improvement, and governance reporting. As a Security Engineer, you will play a key role in ensuring that security incidents are identified, responded to, and resolved effectively and quickly. You'll work with various teams to mitigate risks and improve overall security posture. What you will do: Incident Management: Respond to after-hours security incidents (on-call support). Coordinate event collection, log management, and compliance automation. Address day-to-day security change requests related to security operations. Conduct research and intelligence gathering on emerging threats and exploits. Create new security rules based on identified threats. Perform postmortem analysis of logs, traffic flows, and activities to identify malicious activity. Analyze security incidents involving networking devices, operating systems, endpoint analysis, and network attacks. Work with Technical Authority teams to resolve security incidents. Provide Root Cause Analysis for security incidents, outages, or impairments. Administer authentication and access controls, including user provisioning and deprovisioning. Tools Integration: Integrate security tools (SIEM, VA, IAM) with various network nodes. Deploy policies, signatures, parsers, and rules for security infrastructure. Communicate with vendors (e.g., SIEM, IPS/IDS, IAM) for application-related issues. Process Improvement: Mentor Level 1 analysts to improve detection capabilities within the Security Operations Center (SOC). Prepare Use Cases and MOPs (Method of Procedures) based on identified scenarios. Create and maintain technical operational work instructions. Drive continuous improvement by identifying opportunities to enhance current processes. Governance and Reporting: Provide business intelligence reporting based on SOC and customer needs. Identify and report risks related to security. Perform periodic security reporting and present findings to management or customers. To be successful in this role, you must have: Strong knowledge of information security concepts and best practices. Experience with SIEM tools (e.g., McAfee ESM, QRadar, ArcSight, Splunk). Experience with scanning tools (e.g., Nessus, Qualys, IBM AppScan). Experience with PAM tools (e.g., BeyondTrust, CyberArk). Knowledge of Linux and MS Windows systems with a technical understanding of TCP/IP networks. Understanding of enterprise computing environments, distributed applications, and security controls. Key Qualifications: Education: Graduate in Computer Science or a similar field. Experience: 5 to 11 years of experience, with at least 2 years in IT and 2 years in security. Certifications (Preferred): ITIL certification CCSP (Certified Cloud Security Professional) OSCP (Offensive Security Certified Professional) Security+ CCNA Security or similar certifications. Why This Role? This is a fantastic opportunity for a Security Engineer to develop your career by working with cutting-edge security technologies and supporting a highly dynamic and crucial role in an organization. You will have the chance to mentor junior team members, improve security processes, and work with state-of-the-art tools to ensure the highest levels of security for the organization. Apply now to join our team and contribute to maintaining and improving the security infrastructure! Qualification : Graduate in Computer Science or similar