Infosec Engineer

About the company

Nemetschek India Private Limited is a global organization and with a legacy of over half a century. It is a public company listed on MDAX and TecDAX (Germany) stock exchanges. The Nemetschek Group is a forerunner of digital transformation in the AEC/O (Architecture, Engineering, Construction & Operations) industry and covers the entire life cycle of construction and infrastructure projects. With intelligent software solutions, we lead our customers into the future of digitalization. By using our solutions customers can plan, build, manage, and operate buildings and infrastructure projects.

Your tasks

YOUR ROLE: A chance to make the difference.

ROLES AND RESPONSIBILITY: (Night Shift, triage-focused)

• Monitor and triage security alerts from EDR/XDR (primarily CrowdStrike Falcon), SIEM

(Microsoft Sentinel), and other security tools.

• Perform alert-driven incident handling at L1/L1.5 level:
• Quickly review new detections,
• Decide whether to close as benign/false positive, investigate further, or escalate,
• Apply standard playbook-based response actions where allowed (e.g. isolate

host, block hash/domain, disable account with approval).

• For CrowdStrike Falcon in particular:
• Review detections, examine process trees and related activity,
• Validate severity and impact based on context,
• Close noise/false positives with clear justification or escalate meaningful events.
• Use Microsoft Sentinel and other platforms to pull additional context during triage (host

history, user activity, geo/access patterns, related alerts).

• Analyze and respond to phishing alerts and user-reported suspicious emails using

defined playbooks (header analysis, URL/file sandboxing, user follow-up, ticket updates).

• Review vulnerability scan results (e.g. Tenable) for basic risk context, confirm exposure

where needed, and follow up with the relevant teams according to priority and SLAs.

• Conduct basic, playbook-driven “mini threat hunting” during quieter periods (e.g.

running saved queries/hunts in Sentinel and EDR to look for common attacker techniques or newly published IOCs).

Keep tickets, incident records, and runbooks up to date with short, precise, and complete investigation notes (what triggered, what you checked, what you decided, and why).

• Produce clear shift-end handover notes for open incidents and important observations.

Requirements

We’re looking for a SOC Analyst for our permanent night shift in Hyderabad to focus on high-quality alert triage and first-line incident handling. You’ll work mainly with CrowdStrike Falcon, Microsoft Sentinel, and related security tools to keep our global environment safe while most of the company is asleep.

• 3–5 years in a SOC / security monitoring role (L1 or L1/L2 mix).
• Prior experience in a 24/7 or shift-based SOC is a plus.

Core SOC / triage skills

• 3–5 years of hands-on SOC experience in monitoring, triage, and first-line incident

handling (L1 or L1/L2).

• Strong focus on alert triage rather than deep forensics: able to work through a queue

efficiently, recognize patterns, and make clear decisions (close, investigate further, escalate).

• Experience with:
• At least one enterprise EDR/XDR platform (ideally CrowdStrike Falcon) for alert

analysis and basic response (host isolation, hash/domain blocking, evidence collection).

• A SIEM platform (ideally Microsoft Sentinel) for correlating alerts and running

queries to gather additional context.

• Good understanding of security fundamentals:
• Logs: endpoint, authentication, OS, and basic application logs.
• Endpoints: Windows and/or Linux basics, common processes and admin tools.
• Networks: TCP/IP basics, DNS, web traffic, VPN and remote access patterns.
• Common attack techniques across the kill chain (phishing, credential theft,

lateral movement, malware execution, C2, data exfiltration).

Tools and platforms

• Familiarity with some of the following (or similar solutions):
• CrowdStrike Falcon or another modern EDR/XDR platform.
• Microsoft Sentinel or another SIEM (including experience running and

understanding queries; KQL is a plus).

• Vulnerability management tools such as Tenable.
• Email security / anti-phishing tools, sandboxing, or secure email gateways.

Ways of working and soft skills

• Comfortable working permanently in night shift and collaborating with global teams

spread across regions.

• Strong written communication: able to document alerts, investigations, and handovers in

clear, concise English.

• Ability to stay calm, structured, and pragmatic during active incidents and high-alert

periods.

• Habit of following runbooks and escalation paths, while also giving feedback when you

see gaps or improvement opportunities.

• Ownership mindset: you close the loop on alerts you touch, or you hand them over with

enough context that the next person can continue smoothly.

Nice to have

• Experience in a 24/7 SOC environment with strict SLAs.
• Hands-on experience specifically with CrowdStrike Falcon and Microsoft Sentinel in a

production environment.

• Exposure to SOAR / automation and working with automated playbooks for common use

cases (phishing, malware, brute force, etc.).

• Familiarity with basic vulnerability prioritization (CVSS concepts, asset criticality).
• Security certifications such as:
• CompTIA Security+, CySA+,
• CEH,
• Vendor-specific SOC/EDR/XDR certifications (including CrowdStrike, Microsoft,

etc.).

What we offer

Growth and development Even though this role is centered on triage, we want people who are interested in growing further within the SOC. Over time, you’ll have opportunities to:

• Take on more complex investigations and incident response tasks under guidance from

senior analysts.

• Get involved in improving detection rules, tuning alerts, and enhancing runbooks.
• Develop towards specialist tracks such as incident response, threat hunting, or detection

engineering depending on your strengths and interests.

Other

Shift details

• Location: Hyderabad.
• Permanent night shift, working with EMEA/US time zones.
• Participation in a rotation that may include weekends and holidays.
• Clear handover required at the end of each shift to the next region/shift.