Security Operations Engineer

Key Responsibilities 

1. Vulnerability Assessment & Risk-Based Patch Management 

• Perform infrastructure-level vulnerability assessments (VAPT) across cloud, servers, endpoints, networks, and identity systems. 
• Assess Windows OS and third-party security updates, evaluate exploitability, CVSS severity, and business/product impact. 
• Set up and maintain sandbox or staging environments to test patches before production rollout. 
• Define patch deployment strategies (immediate, phased, deferred with compensating controls). 
• Track vulnerabilities from discovery to closure with clear risk acceptance or remediation decisions. 

2. Endpoint & OS Security 

• Secure and harden Windows/Linux endpoints and servers using CIS benchmarks and security baselines. 
• Manage and tune endpoint protection platforms (AV, EDR, XDR). 
• Investigate malware or suspicious activity, isolate affected systems, and perform root cause analysis (RCA). 
• Reduce attack surface by enforcing secure configurations and least privilege. 

3. Cloud, Identity & Access Security 

• Secure Azure infrastructure using Defender for Cloud / Azure Security Center and native controls. 
• Manage and review Azure Entra ID (Azure AD): 
  • User access reviews and role hygiene 
  • Privileged identity and conditional access 
• Identify risks from unmanaged or shadow SaaS applications (paid and free). 
• Assess credential exposure risks, MFA gaps, and excessive access. 

4. Network & Perimeter Security 

• Review and maintain firewall rules, VPNs, NAT, and network segmentation. 
• Conduct network vulnerability and configuration reviews. 
• Validate intrusion prevention, threat filtering, and secure connectivity. 

5. Incident Detection & Response (No SOC Environment) 

• Act as the first responder for security incidents in the absence of a SOC. 
• Monitor security alerts from endpoint, cloud, and identity platforms. 
• Correlate events, determine impact, and lead containment and remediation. 
• Document incidents, lessons learned, and preventive actions. 

6. Governance, Documentation & Continuous Improvement 

• Translate technical vulnerabilities into clear business risk statements. 
• Maintain vulnerability reports, patch risk assessments, and security baselines. 
• Support audits and compliance efforts (ISO 27001, NIST, CIS). 
• Continuously improve security processes and tooling coverage. 

Tools & Technologies

• Vulnerability Assessment: Nessus, Qualys, MS Defender Vulnerability Management, NMAP 
• Patch & MDM: Intune, ManageEngine, WSUS, Zoho Endpoint Central (planned) 
• Endpoint Security: Microsoft Defender, CrowdStrike, SentinelOne, Sophos Central (planned) 
• Cloud & Identity Security: Azure, Azure Entra ID, Azure Defender, Azure Sentinel (optional, not SOC-driven) 
• Network Security: Sophos XGS 2100, Sophos Connect VPN SSL, FortiGate, Palo Alto, Cisco ASA 
• Email & SaaS Security: O365 Defender, O365 Exchange, O365 SharePoint, O365 Purview, MS Teams Admin portal 
• Dev & Collaboration Tools: Visual Studio Admin, MS DevOps 
• Support & Operations Tools: Freshdesk, Freshservice 
• Physical & Biometric Security: EZ View (CCTV), NetX-Spectra (Biometric App) 

Experience & Skills 

• 4–8 years in infrastructure/cloud security 
• Strong Windows security and patching experience 
• Azure security & identity management expertise 
• Ability to make and justify risk-based security decisions 
• Comfortable working independently without a SOC