Cybersecurity Operations Engineer

At Armanino, you determine your career path. This means it's possible to pursue challenges you are passionate about, in industries you care about.

Armanino (USA) is proud to be among the top 20 Largest Firms in the United States of America and one of the Best Places to Work. Armanino (USA) has more than 2500 employees across the USA and more than 20 offices in different states of the USA. We have a community of resources that are ready and willing to support your ideas, build your skills and expand your professional network. We want you to integrate all aspects of your life with your career. At Armanino, we know you don’t check-out of life when you check-in at work. That’s why we’ve created a unique work environment where your passions, work, and family & friends can overlap. We want to help you achieve growth by giving you access to a network of smart and supportive people, willing to listen to your ideas.

This open position is for Armanino India LLP, which is located in India. Armanino India LLP is a fully owned subsidiary of Armanino (USA).

Responsibilities

• Support the India-based Infrastructure and Cybersecurity Operations Team responsible for day-to-day cybersecurity monitoring and operational response

• Monitor security, identity, endpoint, cloud, email, and infrastructure alerts according to assigned responsibilities and defined procedures

• Take ownership of assigned tickets, alerts, escalations, and follow-up items through resolution or proper handoff

• Maintain clear daily visibility into open work, aging issues, blockers, and items requiring escalation

• Escalate risks, blockers, recurring issues, and operational gaps to team leadership and New York-based teams

• Triage and support cybersecurity incidents across identity, endpoint, cloud, email, network, infrastructure, and collaboration environments

• Follow approved security runbooks for investigation, validation, documentation, response, containment support, and escalation

• Support response for security-impacting issues and communicate status clearly

• Partner with New York-based cybersecurity, infrastructure, platform, and engineering teams on escalated security issues

• Respond to security escalations with extreme urgency and ensure issues are followed through to resolution or proper handoff

• Identify repeat security issues and recommend process, monitoring, automation, or control improvements

• Perform initial review, triage, documentation, and escalation of cybersecurity alerts from security, identity, endpoint, cloud, email, and monitoring platforms

• Ensure alert handling follows approved security runbooks and escalation paths

• Coordinate with cybersecurity, compliance, infrastructure, and cloud teams on incidents that require deeper investigation or escalation

• Track assigned alert activity, response notes, handoffs, and follow-up actions

• Raise patterns, control gaps, and recurring alert issues to New York-based leadership

• Ensure all cybersecurity alerts, incidents, and escalations are handled according to defined security runbooks

• Maintain consistency in ticket documentation, alert notes, handoffs, and escalation summaries

• Review runbook gaps and recommend updates based on recurring operational issues

• Understand expected response steps, communication standards, escalation thresholds, and documentation requirements

• Drive a culture of repeatable execution, ownership, and follow-through

• Maintain clear communication with team leadership, the Director of Core Technology in New York, and New York-based Core Technology and cybersecurity teams on assigned alerts, incidents, escalations, and operational priorities

• Provide concise status updates on active incidents, alerts, risks, and follow-up actions

• Work directly with New York-based teams to ensure clean handoffs, shared visibility, and consistent ownership

• Participate in regular operational reviews, escalation discussions, and planning sessions with U.S.-based leadership

• Ensure availability to work with New York-based teams until at least 12:00 PM Eastern Time

• Take extreme ownership of assigned responsibilities, tickets, alerts, monitoring tasks, and escalations

• Operate as a self-starter who identifies issues, takes action, improves monitoring visibility, and drives work forward without waiting for step-by-step direction

• Maintain strong documentation, clear handoffs, and consistent follow-through on all assigned work

• Work with urgency on escalations, incidents, alerts, and time-sensitive operational issues

• Raise blockers, capacity concerns, skill gaps, and improvement opportunities to team leadership early

Requirements

• 4+ years in cybersecurity operations, security monitoring, incident response support, infrastructure operations, cloud operations, systems administration, or related technology operations role

• Hands-on experience supporting security monitoring, alert triage, incident response workflows, ticketing, documentation, and escalation processes

• Experience managing cybersecurity escalations, monitoring alerts, incident response support, and operational handoffs

• Experience working with U.S.-based or global technology teams

• Experience operating in a structured runbook, ticketing, monitoring, and escalation environment

• Cybersecurity operations across identity, endpoint, cloud, email, network, infrastructure, and collaboration platforms

• Cybersecurity monitoring concepts, alert triage, escalation handling, and incident documentation

• Monitoring and alerting tools, ticketing systems, dashboards, and operational reporting

• Consistent hands-on work with monitoring solutions to improve visibility, alert quality, response accuracy, and operational follow-through

• Microsoft security, identity, endpoint, Microsoft 365, Azure, Windows Server, Active Directory, and network security fundamentals

• Incident management, problem management, change awareness, and operational handoff practices

• Runbook execution, process documentation, escalation procedures, and service operations discipline

• Strong individual ownership, accountability, prioritization, and workload management skills

• Clear, concise communication with New York-based leadership and cross-functional teams

• Excellent verbal and written communication skills with the ability to keep leadership informed during active issues, escalations, and operational handoffs

• Strong judgment on when to resolve, escalate, or request additional support

• Ability to manage multiple operational priorities while maintaining accuracy and urgency

• Extreme ownership mindset with strong documentation, follow-through, accountability, and attention to detail for all assigned responsibilities

• Self-starter who can identify issues, take action, improve monitoring coverage, and drive work forward without waiting for step-by-step direction

• Demonstrates extreme urgency when responding to escalations, alerts, incidents, and time-sensitive operational issues

• Availability to overlap with New York-based teams through at least 12:00 PM Eastern Time

• Experience working on an offshore or India-based technology operations team supporting U.S. stakeholders

• Experience in professional services, consulting, financial services, or other high-accountability enterprise environments

• Experience with Microsoft security, endpoint, identity, and cloud operations tools

• Experience improving runbooks, alert tuning, dashboards, or operational reporting

• ITIL, SOC, NOC, or service operations background

• Certifications: Security+, SC-900, AZ-900, AZ-500, Microsoft security certifications, ITIL Foundation, Network+, or equivalent

Compensation and Benefits

• Compensation: Commensurate with Industry standards
• Other Benefits: Provident Fund, Gratuity, Medical Insurance, Group Personal Accident Insurance etc. employment benefits depending on the position.

"Armanino” is the brand name under which Armanino LLP, Armanino CPA LLP, and Armanino Advisory LLC, independently owned entities, provide professional services in an alternative practice structure in accordance with law, regulations, and professional standards. Armanino LLP and Armanino CPA LLP are licensed independent CPA firms that provide attest services, and Armanino Advisory LLC and its subsidiary entities provide tax, advisory, and business consulting services. Armanino Advisory LLC and its subsidiary entities are not licensed CPA firms.

Armanino provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Armanino complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

Armanino expressly prohibits any form of workplace harassment based on race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, genetic information, disability, or veteran status. Improper interference with the ability of Armanino employees to perform their job duties may result in discipline up to and including discharge.

We have a community of resources that are ready and willing to support your ideas, build your skills and expand your professional network.