Administrator (Support & Operations)

Job description

Job Summary : Department: Security Operations Center (SOC) Experience Level: 1–3 Years Employment Type: Full-time Position Overview We are seeking a detail-oriented and proactive SOC Analyst with 1–3 years of hands-on security operations experience to join our team. In this role, you will serve as a core defender of our digital assets, utilizing Palo Alto Networks Cortex XSIAM to monitor, triage, investigate, and respond to security threats across our network, endpoints, cloud, and identity infrastructure. The ideal candidate understands modern threat landscapes, possesses strong analytical skills, and leverages automation and telemetry to reduce mean time to detect (MTTD) and mean time Key Responsibilities Job Responsibilities : 1. Incident Triage & Response ● Monitor and analyze security alerts, events, and incidents within Palo Alto Cortex XSIAM across endpoint, network, cloud, and identity telemetry sources. ● ● Conduct initial alert triage to differentiate between true positives and false positives, escalating complex threats when necessary. ● ● Perform root cause analysis, risk assessment, and scope determination for verified security incidents. ● ● Execute containment, mitigation, and remediation actions (e.g., endpoint isolation, user credential resets, IP blocking). ● 2. XSIAM Operations & Analysis ● Query and correlate security data across diverse data sources using Cortex Query Language (XQL). ● ● Validate and maintain Cortex XDR agent health across enterprise endpoints. ● ● Interact with automated SOAR playbooks to accelerate incident resolution and streamline repetitive tasks. ● ● Leverage Attack Surface Management (ASM) and Identity Threat Detection & Response (ITDR) modules within XSIAM to identify vulnerabilities and identity risks. ● 3. Threat Detection & Intelligence ● Map observed adversary behaviors and indicators of compromise (IOCs) to the MITRE ATT&CK; framework. ● ● Integrate threat intelligence feeds into detection workflows to proactively hunt for emerging cyber threats. ● ● Assist senior analysts in fine-tuning detection rules and playbook workflows to minimize noise and improve response fidelity. ● 4. Documentation & Collaboration ● Maintain detailed incident logs, ticket updates, and post-incident reports with actionable mitigation recommendations. ● ● Collaborate closely with IT Infrastructure, Cloud, Engineering, and DevOps teams during security incidents. Skill Requirements Skill Requirement : Core Experience & Certifications ● 1 to 3 years of experience working in a Security Operations Center (SOC) or Incident Response environment. ● Direct experience using Palo Alto Networks Cortex XSIAM or Cortex XDR. ● Relevant industry certifications (at least one preferred): ○ Palo Alto Networks Certified XSIAM Analyst or PCDRA (Palo Alto Networks Certified Detection and Remediation Analyst) ○ CompTIA Security+, CySA+, or GIAC (GSEC/GCIH) Technical & Security Focus Skills ● SIEM / XDR / SOAR: Understanding of log ingestion, correlation, alert grouping, and playbook execution within XSIAM. ● Querying Languages: Hands-on ability to write and modify XQL (Cortex Query Language) or similar SIEM query languages (KQL, SPL). ● Networking & Protocols: Solid grasp of TCP/IP, DNS, HTTP/S, VPNs, firewalls, and proxy architecture. ● Operating Systems & Endpoints: Working knowledge of Windows (Registry, Event Logs), Linux, and macOS internal security mechanisms. ● Attack Frameworks: Strong understanding of the MITRE ATT&CK; framework, Cyber Kill Chain, and common vector entry tactics (phishing, drive-by downloads, credential stuffing). ● Identity & Cloud Security: Familiarity with Active Directory, Microsoft Entra ID (Azure AD), SSO, MFA, and general AWS/Azure security concepts. ● Scripting (Plus): Basic proficiency in Python or PowerShell for basic automation and log parsing. Other Requirements Other Requirement : Soft Skills ● Strong problem-solving and critical-thinking abilities under pressure. ● Excellent clear verbal and written technical reporting skills. ● Ability to work effectively in shift/rotational monitoring operational environments. Preferred / Nice-to-Have Skills ● Experience with Palo Alto Next-Generation Firewalls (NGFW) or Prisma Cloud integrations. ● Experience participating in basic threat hunting or tabletop incident response exercises. ● Exposure to forensic artifact collection (memory dumps, PCAP analysis). Apply now Information at a Glance Why HCLTech? At HCLTech, you'll supercharge your potential. You'll find your career. And you'll find your spark. All at a place that knows that helping its customers stay on top starts by putting its people first. HCLTech is a global technology company, home to more than 223,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of 12 months ending June 2026 totaled $14.8 billion. Disclaimer Privacy Statement Terms of use Sitemap Raise a Grievance We use cookies on our site. Please read more about cookies policy here. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Copyright © 2026 HCL Technologies Limited Cookie Consent Manager When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. Required Cookies These cookies are required to use this website and can't be turned off. Required Cookies Required Cookies Provider Description Enabled SAP as service provider We use the following session cookies, which are all required to enable the website to function: "route" is used for session stickiness "careerSiteCompanyId" is used to send the request to the correct data center "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another Cookies from provider SAPasserviceprovider are required and cannot be turned off Functional Cookies These cookies provide a better customer experience on this site, such as by remembering your login details, optimizing video performance, or providing us with information about how our site is used. You may freely choose to accept or decline these cookies at any time. Note that certain functionalities that these third-parties make available may be impacted if you do not accept these cookies. Consent to all Functional Cookies Functional Cookies Provider Description Enabled Vimeo Vimeo is a video hosting, sharing, and services platform focused on the delivery of video. Opting out of Vimeo cookies will disable your ability to watch or interact with Vimeo videos. Cookie Policy Privacy Policy Terms and Conditions Consent to cookies from provider Vimeo YouTube YouTube is a video-sharing service where users can create their own profile, upload videos, watch, like, and comment on videos. Opting out of YouTube cookies will disable your ability to watch or interact with YouTube videos. Cookie Policy Privacy Policy Terms and Conditions Consent to cookies from provider YouTube Advertising Cookies These cookies serve ads that are relevant to your interests. You may freely choose to accept or decline these cookies at any time. Note that certain functionality that these third parties make available may be impacted if you do not accept these cookies. Consent to all Advertising Cookies Advertising Cookies Prov