Track Lead Security Investigations, SIEM

Job description

The Track Lead (Support & Operations) plays a pivotal role in managing security event investigations and implementing technical solutions within the organization. This position focuses on enhancing operational efficiencies, ensuring client satisfaction, and fostering a culture of continuous improvement and innovation among teams. The Track Lead is instrumental in aligning operational goals with organizational objectives while empowering teams to meet client SLAs effectively. Responsible for proactively identifying, investigating, and mitigating advanced cyber threats that evade traditional, alert ‑ driven security controls. The role focuses on hypothesis-driven and intelligence-led threat hunting across endpoint, network, identity, and cloud environments to reduce dwell time and enhance detection maturity. Key Responsibilities 1. Implement And Optimize Soar Solutions To Automate Security Event Investigations, Ensuring Timely And Accurate Incident Response While Enhancing Overall Operational Efficiency. 2. Develop And Maintain Comprehensive Reporting Systems Using Siem Tools To Provide Insights Into Security Incidents And Operational Performance, Facilitating Informed Decision-Making. 3. Lead And Mentor The Support Team By Fostering Transparent Communication Of Project Goals And Encouraging The Adoption Of Best Practices In Security Operations. 4. Collaborate With Clients To Thoroughly Understand Their Security Needs, Ensuring The Support Team Delivers Tailored Solutions That Exceed Client Expectations. 5. Drive Innovation By Identifying Opportunities For Process Improvements And Implementing New Ideas That Enhance The Effectiveness Of Security Operations. Conduct hypothesis-based and IOC-driven threat hunting across: Endpoint (EDR/XDR) SIEM / Log Management platforms Network telemetry (NDR) Identity logs (AD / Entra ID) Cloud platforms (Azure, AWS, M365) Identify stealthy and advanced threats, including: Living‑off‑the‑Land (LotL) techniques Advanced Persistent Threats (APTs) Lateral movement and privilege escalation Insider threat indicators Develop and execute MITRE ATT&CK–aligned hunting hypotheses Convert hunting findings into: Security incidents New detection rules (SIEM / EDR / XDR) Change or service requests (misconfigurations, logging gaps) Collaborate with SOC, Incident Response, and Threat Intelligence teams Produce hunting reports and KPIs (dwell time reduction, hunts to detections, incidents generated) Skill Requirements 1. Strong Proficiency In Security Event Investigation And Soar Technologies. 2. In-Depth Knowledge Of Siem Tools And Their Application In Operational Environments. 3. Excellent Problem-Solving Abilities And A Strong Understanding Of Client Relationship Management. 4. Proven Leadership Skills With The Ability To Mentor And Empower Teams Effectively. Strong expertise in SIEM/SOAR platforms (Splunk, Microsoft Sentinel, Chronicle, Palo Alto XSIAM) Hands-on experience with EDR/XDR tools (Microsoft XDR, CrowdStrike, SentinelOne, Palo Alto Cortex) Proficiency in KQL / SPL / advanced hunting queries Deep understanding of MITRE ATT&CK techniques and TTPs Strong OS knowledge: Windows, Linux, macOS Basic scripting skills (PowerShell / Python preferred) Cloud security exposure (Azure, AWS, M365 Defender) Other Requirements 1. Optional But Valuable Certifications: Certified Information Systems Security Professional (Cissp), Security+ Certification, Or Any Relevant Soar Or Siem Certifications Apply now Information at a Glance Why HCLTech? At HCLTech, you'll supercharge your potential. You'll find your career. And you'll find your spark. All at a place that knows that helping its customers stay on top starts by putting its people first. HCLTech is a global technology company, home to more than 230,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of 12 months ending September 2026 totaled $14.8 billion. Disclaimer Privacy Statement Terms of use Sitemap Raise a Grievance We use cookies on our site. Please read more about cookies policy here. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Opens in a new tab. Copyright © 2026 HCL Technologies Limited Cookie Consent Manager When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. Required Cookies These cookies are required to use this website and can't be turned off. Required Cookies Required Cookies Provider Description Enabled SAP as service provider We use the following session cookies, which are all required to enable the website to function: "route" is used for session stickiness "careerSiteCompanyId" is used to send the request to the correct data center "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another Cookies from provider SAPasserviceprovider are required and cannot be turned off Functional Cookies These cookies provide a better customer experience on this site, such as by remembering your login details, optimizing video performance, or providing us with information about how our site is used. You may freely choose to accept or decline these cookies at any time. Note that certain functionalities that these third-parties make available may be impacted if you do not accept these cookies. Consent to all Functional Cookies Functional Cookies Provider Description Enabled Vimeo Vimeo is a video hosting, sharing, and services platform focused on the delivery of video. Opting out of Vimeo cookies will disable your ability to watch or interact with Vimeo videos. Cookie Policy Privacy Policy Terms and Conditions Consent to cookies from provider Vimeo YouTube YouTube is a video-sharing service where users can create their own profile, upload videos, watch, like, and comment on videos. Opting out of YouTube cookies will disable your ability to watch or interact with YouTube videos. Cookie Policy Privacy Policy Terms and Conditions Consent to cookies from provider YouTube Advertising Cookies These cookies serve ads that are relevant to your interests. You may freely choose to accept or decline these cookies at any time. Note that certain functionality that these third parties make available may be impacted if you do not accept these cookies. Consent to all Advertising Cookies Advertising Cookies Provider Description Enabled Google Analytics Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Cookie Information Privacy Policy Terms and Conditions Consent to cookies from provider GoogleAnalytics Google Tag Manager Google Tag Manager is a tag management system for conversion tracking, site analytics, remarketing, and more. Privacy Policy Terms and Conditions Consent to cookies from provider GoogleTagManager LinkedIn LinkedIn is an employment-oriented social networking service. We use the Apply with LinkedIn feature to allow you to apply for jobs using your LinkedIn profile. Opting out of LinkedIn cookies will disable your ability to use Apply with LinkedIn. Cookie Policy Cookie Table Privacy Policy Terms and Conditions Consent to cookies from provider LinkedIn