Senior lead security operations

An Amazing Career Opportunity for Senior Lead Security Operations Engineer Location: Chennai, India (Hybrid) Job ID: 52753 Profile Summary The Senior Lead Security Operations Engineer is a senior hands-on security practitioner who provides technical leadership across security monitoring, threat hunting, incident response, network security, vulnerability management, penetration testing, and application security. The role acts as a trusted delegate for the Manager – Security Operations, represents Security Operations in technical and cross-functional forums, and converts identified risk into practical remediation and measurable operational improvement. About HID Global HID Global powers the trusted identities of the world’s people, places and things. We make it possible for people to transact safely, work productively and travel freely. Our trusted identity solutions give people secure and convenient access to physical and digital places and connect things that can be accurately identified, verified and tracked digitally. Millions of people around the world use HID products and services to navigate their everyday lives, and over 2 billion things are connected through HID. We work with governments, educational institutions, hospitals, financial institutions, industrial businesses, and some of the most innovative companies on the planet. Headquartered in Austin, Texas, HID Global has over 4500 employees worldwide and operates international offices that support more than 100 countries. HID Global® is an ASSA ABLOY Group brand. HID Global has is the trusted source for secure identity solutions for millions of customers and users around the world. In India, we have two Engineering Centre (Bangalore and Chennai). Global Engineering Team is based in Chennai and one of the Business Unit Engineering team is based in Bangalore. Check us out: www.hidglobal.com and https://youtu.be/23km5H4K9Eo LinkedIn: www.linkedin.com/company/hidglobal/mycompany/ Are You Ready to Join the Team? Our company is committed to finding the best and the brightest talent to help us reach the top. If you are a dynamic, highly skilled, experienced Cloud engineer and technology enthusiast, and you enjoy working in a rapid pace within a rapidly growing business environment, then you will want to consider this position. If you excel at communication, collaboration, and unrelenting innovation, we want to talk to you. And if you bring dedication, positive energy and integrity to the table, you just might be the right fit for our team. Qualifications The individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. Key Outcomes Improve detection coverage and investigation quality across endpoint, identity, network, cloud, and application telemetry. Lead complex incident investigations from initial triage through containment, eradication, recovery, root-cause analysis, and lessons learned. Identify exploitable weaknesses through threat hunting, vulnerability analysis, application security review, and authorized penetration testing. Drive remediation with infrastructure, network, cloud, identity, development, and business application owners. Mentor SOC engineers, improve playbooks and detection logic, and provide calm technical leadership during high-severity events. Duties and Responsibilities include and are not limited to the following. Security Operations, Detection & Threat Hunting Lead advanced triage and investigation of endpoint, network, identity, email, cloud, and application security alerts. Develop hypothesis-driven threat hunts using SIEM, EDR/XDR, firewall, DNS, proxy, authentication, and vulnerability data; document evidence, conclusions, and follow-up actions. Engineer, tune, and validate detections to improve fidelity, reduce false positives, and map coverage to MITRE ATT&CK techniques. Build investigation workflows and queries for suspicious authentication, lateral movement, command execution, persistence, data staging, beaconing, and exfiltration behaviors. Perform incident command or technical-lead duties for major events and coordinate evidence preservation, containment, recovery, and post-incident improvements. Must have good experience in using LLM’s for security posture improvements. Network, Endpoint & Identity Security Provide senior technical support for firewalls, IPS/IDS, endpoint protection, EDR/XDR, secure remote access, network security monitoring, and security analytics platforms. Review network security policies and security profiles using least privilege, risk, business context, and change-control requirements. Investigate anomalous remote access, privileged activity, service-account use, account lifecycle events, and unusual east-west or outbound traffic. Partner with infrastructure and platform teams to validate remediation, compensating controls, and residual risk. Application Security & Penetration Testing Plan and execute authorized penetration tests of web applications, APIs, and supporting infrastructure; define scope, rules of engagement, evidence handling, and retest criteria. Assess common application and API weaknesses using OWASP Top 10, OWASP API Security Top 10, threat modeling, secure design review, and manual testing techniques. Advise product and engineering teams on practical placement and use of SAST, DAST, software composition analysis, secrets scanning, container scanning, and infrastructure-as-code scanning within the SDLC. Validate exploitability, business impact, attack paths, and remediation effectiveness; produce clear technical findings and executive summaries. Facilitate threat-modeling sessions covering assets, trust boundaries, abuse cases, security controls, and residual risks before significant releases or architectural changes. Vulnerability & Exposure Management Lead risk-based prioritization using exploitability, asset criticality, internet exposure, active exploitation, compensating controls, and business impact rather than severity score alone. Coordinate remediation and exception workflows with asset owners; validate closure through rescanning, configuration review, or technical retesting. Analyze recurring weaknesses and control gaps, and recommend preventive actions across configuration, patching, architecture, and secure development practices. Automation, Engineering & Operational Excellence Automate repeatable analysis, enrichment, reporting, and response activities using scripting, APIs, SOAR, reusable templates, and version-controlled content. Maintain runbooks, detection documentation, architecture diagrams, integration details, operational procedures, and knowledge-transfer materials. Define meaningful operational measures for detection coverage, investigation quality, response, remediation ageing, recurrence, and control effectiveness. Evaluate security tooling and integrations through structured testing, operational fit, telemetry quality, scalability, and maintainability. Technical Leadership & Representation Act as a technical delegate for the Manager – Security Operations in operational reviews, incident forums, architecture discussions, audits, and cross-functional meetings. Provide clear risk-based recommendations to technical and non-technical stakeholders without overstating certainty or impact. Mentor analysts and engineers through case reviews, hunt development, detection engineering, application security, and incident-response exercises. Coordinate effectively across regions and time zones and participate in the 24x7 on-call rotation as required. Required Qualifications Experience with SentinelOne or a comparable EDR/XDR platform; Splunk or a comparable SIEM; Fortinet/FortiGate/FortiAnalyzer or comparable network security technologies; and enterprise vulnerability-management platforms. Experience securing cloud, container, Kubernetes, DevSecOps, and infrastructure-as-code environments. Experience conducting forensic analysis, purple-team exercises, attack-path analysis, or adversary emulation in authorized environments. Relevant certifications such as CISSP, GIAC (GCIH, GCIA, GPEN), OSCP/OSWE, CREST, or cloud-security certifications. Certifications are valued as supporting evidence, not a substitute for demonstrated hands-on capability. Experience supporting globally distributed teams and regulated or high-availability environments. Education And/Or Qualification: 13 to 15 years of progressive cybersecurity or closely related engineering experience, including at least 5 years in security operations, incident response, detection engineering, or threat hunting. Demonstrated hands-on experience leading complex security investigations and communicating evidence, risk, decisions, and remediation actions. Practical experience with SIEM and EDR/XDR platforms, firewall or network security telemetry, identity and authentication logs, vulnerability scanners, and ticket or case-management workflows. Hands-on web application and API penetration-testing experience, including manual validation and clear reporting of reproducible findings. Strong understanding of TCP/IP, DNS, HTTP/S, TLS, authentication, Windows and Linux security, Active Directory or modern identity platforms, and cloud security fundamentals. Experience with vulnerability and exposure management, risk-based prioritization, remediation validation, and exception governance. Working knowledge of secure SDLC controls, SAST, DAST, software composition analysis, secrets management, threat modeling, and CI/CD security integration. Proficiency in at least one scripting or query language used for security analysis or automation, such as Python, PowerShell, Bash, SPL, KQL, SQL, or a platform-specific query language. Ability to lead technical discussions, mentor team members, manage competing priorities, and operate effectively during high-pressure incidents. Must have experience in effectively using AI models for Security operations and security posture development. Strong written and verbal English communication skills, including executive-ready summaries and technically precise documentation. Leadership Behaviors Hands-on ownership: moves from alert or finding to evidence-based conclusion and verified remediation. Judgment: distinguishes true risk from technical noise and makes proportionate recommendations. Collaboration: challenges constructively, listens to operational constraints, and builds agreement around secure outcomes. Communication: adapts depth and language for analysts, engineers, product teams, auditors, and executives. Learning mindset: stays current, tests assumptions, shares knowledge, and continuously improves controls and team capability. Interview Evidence to Validate Candidates should be assessed through practical evidence rather than tool-name familiarity alone. The interview process should validate: A structured investigation of a multi-source security incident using endpoint, firewall, identity, DNS, and application evidence. A threat-hunting scenario requiring a hypothesis, queries, exclusions, validation steps, and a defensible conclusion. A web application or API security scenario covering attack surface, testing approach, exploitability, remediation, and retesting. A detection-tuning exercise that balances coverage, false positives, and operational impact. An example of leading remediation across teams when ownership, business impact, or exception requirements are contested. Ability to brief the same issue to both engineers and senior leadership. Work Requirements Participate in an on-call rotation and perform after-hours work when required for major incidents, critical changes, or global operational needs. Comply with applicable HID Global policies and procedures related to quality, security, safety, business continuity, privacy, and environmental systems. Perform only formally authorized security testing and follow approved scope, evidence-handling, and disclosure requirements. Reasonable accommodations may be made to enable qualified individuals to perform the essential functions of the role. Document note: This revision positions the role as a senior hands-on lead with balanced depth across SOC operations, threat hunting, incident response, network and identity security, vulnerability management, application security, penetration testing, automation, and stakeholder representation. Why apply? Empowerment: You’ll work as part of a global team in a flexible work environment, learning and enhancing your expertise. We welcome an opportunity to meet you and learn about your unique talents, skills, and experiences. You don’t need to check all the boxes. If you have most of the skills and experience, we want you to apply. Innovation: You embrace challenges and want to drive change. We are open to ideas, including flexible work arrangements, job sharing or part-time job seekers. Integrity: You are results-orientated, reliable, and straightforward and value being treated accordingly. We want all our employees to be themselves, to feel appreciated and accepted. This opportunity may be open to flexible working arrangements. HID is an Equal Opportunity/Affirmative Action Employer – Minority/Female/Disability/Veteran/Gender Identity/Sexual Orientation. We make it easier for people to get where they want to go! On an average day, think of how many times you tap, twist, tag, push or swipe to get access, find information, connect with others or track something. HID technology is behind billions of interactions, in more than 100 countries. We help you create a verified, trusted identity that can get you where you need to go – without having to think about it. When you join our HID team, you’ll also be part of the ASSA ABLOY Group, the global leader in access solutions. You’ll have 63,000 colleagues in more than 70 different countries. We empower our people to build their career around their aspirations and our ambitions – supporting them with regular feedback, training, and development opportunities. Our colleagues think broadly about where they can make the most impact, and we encourage them to grow their role locally, regionally, or even internationally. As we welcome new people on board, it’s important to us to have diverse, inclusive teams, and we value different perspectives and experiences. #LI-HIDGlobal