Information & Cybersec Lead

Job Description

Information & Cybersec Lead

Gautam Buddha Nagar, Uttar Pradesh

Job Summary

Location: Noida/Bangalore / Hybrid

Experience: 8+ Years in Cyber Security with proven Threat Hunting experience

Employment Type: Full-Time

Role Overview

We are seeking a highly skilled Senior Threat Hunter to lead proactive threat hunting initiatives and detect advanced cyber threats that evade traditional security controls. The ideal candidate will possess deep expertise in adversary tactics, threat intelligence, detection engineering, and incident response, with the ability to translate complex security findings into actionable business insights. This role acts as a Tier-4 escalation point, supports SOC maturity, and drives continuous improvement of detection and response capabilities across on-prem, cloud, and hybrid environments.

Key Responsibilities

Threat Hunting & Adversary Detection

• Lead hypothesis-driven threat hunting across endpoint, network, cloud, identity, and SaaS platforms.
• Detect advanced threats including APTs, insider threats, credential abuse, lateral movement, and fileless attacks.
• Analyze datasets from EDR/XDR, SIEM, NDR, email, identity, and cloud logs.
• Map findings to MITRE ATT&CK framework and attacker TTPs.

Detection Engineering & Automation

• Recommend , tune, and optimize detection rules in SIEM and EDR platforms.
• Translate hunt results into reusable detection use cases.
• Automate workflows using KQL, SPL, Python, PowerShell, and SOAR.
• Reduce false positives and improve signal-to-noise ratio.

Threat Intelligence & Research

• Consume strategic and tactical threat intelligence.
• Track emerging threats and attacker techniques.
• Participate in purple team exercises and adversary simulations.

Incident Response & Advanced Investigations

• Serve as escalation point for complex security incidents.
• Support containment, eradication, and recovery activities.
• Perform root cause analysis and post-incident reporting.

Cloud & Identity Security Hunting

• Conduct threat hunting in Microsoft 365, Azure, AWS, and other cloud environments.
• Detect OAuth abuse, MFA bypass, token theft, and persistence mechanisms.

Reporting, Metrics & Leadership Communication

• Prepare executive-level threat hunting and risk reports.
• Track metrics such as MTTD, dwell time, and ATT&CK coverage.

Mentorship & Program Maturity

• Mentor junior threat hunters , SOC analysts and Threat intel team .
• Develop hunt playbooks and training materials.
• Collaborate with Red Team, IR, GRC, and IT teams.

Required Skills & Qualifications

Technical Skills

• Experience with SIEM/SOAR platforms (Microsoft Sentinel, Splunk, QRadar)
• Hands-on with EDR/XDR solutions (Defender, CrowdStrike, SentinelOne and Splunk)
• Strong understanding of MITRE ATT&CK framework
• Proficiency in KQL, SPL, Python, and PowerShell
• Endpoint, network, and cloud forensics
• Cloud security expertise (Azure/AWS/GCP)

Professional Skills

• Strong analytical and problem-solving skills
• Excellent written and verbal communication
• Ability to explain complex threats to non-technical audiences
• Ability to work independently under pressure and ready for 24x7 support.

Preferred Certifications

• GCED, GCTI, GCIA, GMON
• CISSP / CISM
• Microsoft Security Certifications
• Cloud Security Certifications (Azure/AWS)

Key Responsibilities

Key Responsibilities

Threat Hunting & Adversary Detection

• Lead hypothesis-driven threat hunting across endpoint, network, cloud, identity, and SaaS platforms.
• Detect advanced threats including APTs, insider threats, credential abuse, lateral movement, and fileless attacks.
• Analyze datasets from EDR/XDR, SIEM, NDR, email, identity, and cloud logs.
• Map findings to MITRE ATT&CK framework and attacker TTPs.

Detection Engineering & Automation

• Recommend , tune, and optimize detection rules in SIEM and EDR platforms.
• Translate hunt results into reusable detection use cases.
• Automate workflows using KQL, SPL, Python, PowerShell, and SOAR.
• Reduce false positives and improve signal-to-noise ratio.

Threat Intelligence & Research

• Consume strategic and tactical threat intelligence.
• Track emerging threats and attacker techniques.
• Participate in purple team exercises and adversary simulations.

Incident Response & Advanced Investigations

• Serve as escalation point for complex security incidents.
• Support containment, eradication, and recovery activities.
• Perform root cause analysis and post-incident reporting.

Cloud & Identity Security Hunting

• Conduct threat hunting in Microsoft 365, Azure, AWS, and other cloud environments.
• Detect OAuth abuse, MFA bypass, token theft, and persistence mechanisms.

Reporting, Metrics & Leadership Communication

• Prepare executive-level threat hunting and risk reports.
• Track metrics such as MTTD, dwell time, and ATT&CK coverage.

Mentorship & Program Maturity

• Mentor junior threat hunters , SOC analysts and Threat intel team .
• Develop hunt playbooks and training materials.
• Collaborate with Red Team, IR, GRC, and IT teams.

Skill Requirements

Other Requirements

Apply now

Information at a Glance

Why HCLTech?

At HCLTech, youll supercharge your potential. Youll find your career. And youll find your spark. All at a place that knows that helping its customers stay on top starts by putting its people first.

HCLTech is a global technology company, home to more than 223,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of 12 months ending June 2026 totaled $14.8 billion.