SOC Engineer 3 at Cashfree Payments India Private Limited

Bellandur, karnataka, India -

Full Time

Start Date

Immediate

Expiry Date

27 May, 26

Salary

0.0

Posted On

26 Feb, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Detection Engineering, Incident Response Leadership, Automation, SIEM, EDR, MITRE ATT&CK, Cloud Security, Kubernetes, Threat Hunting, Digital Forensics, SOAR, Python, SOPs, KPI Management, Mentoring, PCI-DSS

Industry

Financial Services

Description

SOC Engineer - 3 Detection Engineering, Incident Leadership & Operational Excellence Location: Bangalore (Work From Office) Reports to: CISO Cashfree Payments operates mission-critical payment and API infrastructure under RBI and PCI-DSS oversight. Our environment processes high-volume financial transactions and demands high-fidelity detection, rapid response, and operational resilience. We are building an automation-driven SOC designed to scale beyond traditional monitoring models. Role Summary The SOC Engineer - 3 is a senior, hands-on technical expert pivotal in accelerating the defensive posture and operational maturity of the Cashfree Payments SOC. This role moves beyond traditional monitoring, focusing instead on Detection Engineering, Incident Response Leadership, and operational scaling within our high-volume, regulated Fintech environment. We are looking for a system-thinker and builder who can autonomously architect scalable, automation-driven security solutions. Key Responsibilities Detection and Threat Engineering ● Architect, develop, implement, and continually tune detection rules and correlation logic across SIEM and EDR platforms. ● Proactively identify and remediate detection gaps, mapping coverage to the MITRE ATT&CK framework and leveraging threat intelligence, with a special focus on cloud (AWS), containerized (Kubernetes), and payment systems. ● Implement advanced contextual alerting and enrichment strategies to drastically reduce false positive rates and combat alert fatigue. ● Conduct proactive, hypothesis-driven hunting exercises across diverse telemetry sources (cloud, network, endpoint) to uncover covert threats. Incident Response Leadership & Handling ● Function as the primary technical lead for high-severity and complex security incidents, driving effective containment, eradication, and recovery strategies. ● Execute in-depth log analysis, digital forensics triage, and timeline reconstruction to determine the root cause and scope of compromise. ● Translate findings and lessons learned from incidents into immediate, measurable improvements in detection and prevention mechanisms. ● Ensure meticulous documentation of all incidents, including technical steps, post-incident reviews, and executive summaries. SOC Operational Maturity & Automation ● Design, develop, and maintain automation playbooks using SOAR platforms to streamline repetitive tasks, triage, and incident response workflows. ● Utilize strong scripting skills (e.g. Python) to engineer custom tools and automation solutions, reducing manual effort and increasing response consistency. ● Establish and refine Standard Operating Procedures (SOPs) and investigation playbooks, ensuring they are current, effective, and adopted across the team. Performance & Team Enablement ● Take full ownership of critical SOC metrics, including Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and False Positive Rate. Drive measurable improvement quarter over quarter. ● Mentor and coach SOC team, elevating their investigative, analytical, and tooling skills. ● Plan and execute periodic simulation exercises (e.g., tabletop exercises, purple team engagements) to test and validate SOC readiness and playbooks. Required Qualifications and Expertise Technical Foundation ● B.Tech. in Computer Science, Electrical, or Computer Engineering or equivalent practical experience. ● 7+ years of hands-on experience in a dedicated Security Operations Center (SOC), Incident Response, or Detection Engineering role. ● Expert-level proficiency in SIEM platforms (e.g., Splunk, Elastic, Sentinel) including advanced rule creation, custom parsing, and dashboard development. ● Demonstrated strong scripting skills in Python for security automation and data manipulation. ● Excellent understanding of TCP/IP, common network protocols, and the function of security appliances (Firewalls, IDS/IPS, Proxies). Soft Skills & Leadership ● Proven ability to operate independently, set priorities, and drive complex projects from concept to completion. ● Exceptional analytical and problem-solving skills for complex, multi-stage security incidents. ● Strong verbal and written communication skills for both technical and executive audiences. ● Experience working in a PCI-DSS or RBI-regulated environment is highly desirable. What Excellence Looks Like ● Significant reduction in alert fatigue ● Improved detection coverage and signal accuracy ● Faster, more consistent incident response ● Clear improvements in SOC KPIs over time ● Audit evidence readily available without reactive effort ● SOC processes become automation-driven and scalable

Responsibilities

This senior role focuses on accelerating defensive posture through Detection Engineering, leading high-severity incidents, and scaling the SOC using automation-driven security solutions in a regulated Fintech environment. Key duties include architecting detection rules, leading incident response, and developing SOAR playbooks.