Infosec Engineer

Company Description

Nemetschek India Private Limited is a global organization and with a legacy of over half a century.
It is a public company listed on MDAX and TecDAX (Germany) stock exchanges. The Nemetschek
Group is a forerunner of digital transformation in the AEC/O (Architecture, Engineering,
Construction & Operations) industry and covers the entire life cycle of construction and
infrastructure projects. With intelligent software solutions, we lead our customers into the future
of digitalization. By using our solutions customers can plan, build, manage, and operate buildings
and infrastructure projects.

Job Description

YOUR ROLE: A chance to make the difference.

We’re looking for a SOC Analyst for our permanent night shift in Hyderabad to focus on
high-quality alert triage and first-line incident handling. You’ll work mainly with CrowdStrike
Falcon, Microsoft Sentinel, and related security tools to keep our global environment safe while
most of the company is asleep.
Experience
• 3–5 years in a SOC / security monitoring role (L1 or L1/L2 mix).
• Prior experience in a 24/7 or shift-based SOC is a plus.

Shift details
• Location: Hyderabad.
• Permanent night shift, working with EMEA/US time zones.
• Participation in a rotation that may include weekends and holidays.
• Clear handover required at the end of each shift to the next region/shift.
ROLES AND RESPONSIBILITY: (Night Shift, triage-focused)
• Monitor and triage security alerts from EDR/XDR (primarily CrowdStrike Falcon), SIEM
(Microsoft Sentinel), and other security tools.
• Perform alert-driven incident handling at L1/L1.5 level:
o Quickly review new detections,
o Decide whether to close as benign/false positive, investigate further, or escalate,
o Apply standard playbook-based response actions where allowed (e.g. isolate
host, block hash/domain, disable account with approval).
• For CrowdStrike Falcon in particular:
o Review detections, examine process trees and related activity,
o Validate severity and impact based on context,
o Close noise/false positives with clear justification or escalate meaningful events.
• Use Microsoft Sentinel and other platforms to pull additional context during triage (host
history, user activity, geo/access patterns, related alerts).
• Analyze and respond to phishing alerts and user-reported suspicious emails using
defined playbooks (header analysis, URL/file sandboxing, user follow-up, ticket
updates).
• Review vulnerability scan results (e.g. Tenable) for basic risk context, confirm exposure
where needed, and follow up with the relevant teams according to priority and SLAs.
• Conduct basic, playbook-driven “mini threat hunting” during quieter periods (e.g.
running saved queries/hunts in Sentinel and EDR to look for common attacker
techniques or newly published IOCs).

Keep tickets, incident records, and runbooks up to date with short, precise, and complete
investigation notes (what triggered, what you checked, what you decided, and why).
• Produce clear shift-end handover notes for open incidents and important observations.

WHO ARE WE LOOKING FOR:
Core SOC / triage skills
• 3–5 years of hands-on SOC experience in monitoring, triage, and first-line incident
handling (L1 or L1/L2).
• Strong focus on alert triage rather than deep forensics: able to work through a queue
efficiently, recognize patterns, and make clear decisions (close, investigate further,
escalate).
• Experience with:
o At least one enterprise EDR/XDR platform (ideally CrowdStrike Falcon) for alert
analysis and basic response (host isolation, hash/domain blocking, evidence
collection).
o A SIEM platform (ideally Microsoft Sentinel) for correlating alerts and running
queries to gather additional context.
• Good understanding of security fundamentals:
o Logs: endpoint, authentication, OS, and basic application logs.
o Endpoints: Windows and/or Linux basics, common processes and admin tools.
o Networks: TCP/IP basics, DNS, web traffic, VPN and remote access patterns.
o Common attack techniques across the kill chain (phishing, credential theft,
lateral movement, malware execution, C2, data exfiltration).
Tools and platforms
• Familiarity with some of the following (or similar solutions):
o CrowdStrike Falcon or another modern EDR/XDR platform.
o Microsoft Sentinel or another SIEM (including experience running and
understanding queries; KQL is a plus).
o Vulnerability management tools such as Tenable.
o Email security / anti-phishing tools, sandboxing, or secure email gateways.
Ways of working and soft skills

Comfortable working permanently in night shift and collaborating with global teams
spread across regions.
• Strong written communication: able to document alerts, investigations, and handovers in
clear, concise English.
• Ability to stay calm, structured, and pragmatic during active incidents and high-alert
periods.
• Habit of following runbooks and escalation paths, while also giving feedback when you
see gaps or improvement opportunities.
• Ownership mindset: you close the loop on alerts you touch, or you hand them over with
enough context that the next person can continue smoothly.

Qualifications

Nice to have
• Experience in a 24/7 SOC environment with strict SLAs.
• Hands-on experience specifically with CrowdStrike Falcon and Microsoft Sentinel in a
production environment.
• Exposure to SOAR / automation and working with automated playbooks for common use
cases (phishing, malware, brute force, etc.).
• Familiarity with basic vulnerability prioritization (CVSS concepts, asset criticality).
• Security certifications such as:
o CompTIA Security+, CySA+,
o CEH,
o Vendor-specific SOC/EDR/XDR certifications (including CrowdStrike, Microsoft,
etc.).
Growth and development
Even though this role is centered on triage, we want people who are interested in growing
further within the SOC. Over time, you’ll have opportunities to:
• Take on more complex investigations and incident response tasks under guidance from
senior analysts.
• Get involved in improving detection rules, tuning alerts, and enhancing runbooks.
• Develop towards specialist tracks such as incident response, threat hunting, or detection
engineering depending on your strengths and interests.
 

Additional Information

#NemetschekIndia #LI-Hybrid #LI-NB1