Minimum Salary: -

ZS is a place where passion changes lives. As a management consulting and technology firm focused on improving life and how we live it, our most valuable asset is our people. Here you'll work side-by-side with a powerful collective of thinkers and experts shaping life-changing solutions for patients, caregivers and consumers, worldwide. ZSers drive impact by bringing a client first mentality to each and every engagement. We partner collaboratively with our clients to develop custom solutions and technology products that create value and deliver company results across critical areas of their business. Bring your curiosity for learning; bold ideas; courage and passion to drive life-changing impact to ZS.

• Manage the day-to-day operations of Microsoft Sentinel / Splunk, including rule creation, log ingestion, data analytics, and alert triaging.
• Drive SIEM migration efforts, including planning, implementation, and post-migration optimization.
• Develop and tune detection rules, use cases, and analytics within Sentinel to improve threat visibility and detection capabilities.
• Perform proactive threat hunting to identify and mitigate advanced threats.
• Conduct in-depth incident investigations and coordinate response efforts to ensure swift remediation.
• Collaborate with internal stakeholders and the Threat Intelligence team to identify and mitigate potential security threats.
• Generate reports and dashboards to communicate SOC performance metrics and security posture to leadership.
• Continuously improve SOC processes and playbooks to streamline operations and response efforts.
• Mentor junior SOC analysts and provide guidance on security best practices.
• This role requires participation in a rotational shift.
• Flexibility and availability to respond to urgent incidents outside of assigned shifts as needed.

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field (or equivalent experience).
• 4+ years of experience in a Security Operations Center (SOC) environment, with a focus on SIEM management.
• Strong hands-on experience with Microsoft Sentinel, including data connectors, KQL queries, analytics rules, and workbooks.
• Experience with SIEM migration.
• Expertise in incident response, threat detection, and security monitoring.
• Solid understanding of Windows, Linux, and cloud security concepts.
• Relevant certifications (e.g., Microsoft Certified: Security Operations Analyst, GCIA, GCIH, OSDA, GCFA) are preferred.
• Preferred Security Cloud Certifications: AWS Security Specialty
• Strong analytical and problem-solving abilities.

• Excellent communication and interpersonal skills to effectively collaborate with cross-functional teams.
• Proven ability to remain calm and efficient under pressure in high-stress environments.
• Proficient in using SIEM tools, such as Microsoft Sentinel and Splunk.
• Experience with data migration strategies across SIEM platforms.
• In-depth understanding of cyber threats, vulnerabilities, and attack vectors.
• Proficient in creating KQL queries and custom alerts within Microsoft Sentinel.
• Expertise in developing SIEM use cases and detection rules.
• Skilled in incident response and management procedures.
• Experienced in conducting deep-dive investigations and root cause analysis for incidents.
• Adept at collaborating with stakeholders to resolve complex cybersecurity challenges.
• Ability to automate routine SOC processes to enhance operational efficiency.
• Experienced in mentoring and guiding junior analysts in security operations.
• Knowledge of major cloud platforms (AWS, Azure, GCP), including their security models, IAM roles, virtual private cloud (VPC) configurations, and cloud-native security tools.