{"id":2615934,"url":"https://alion.io/job/armanino-cybersecurity-operations-engineer","title":"Cybersecurity Operations Engineer","company":{"id":4417640,"name":"Armanino","domain":"armanino.in","url":"https://alion.io/company/armanino-2","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Ahmedabad, India","Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":11000,"max_usd":26000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Azure","optional":false},{"name":"Incident Management","optional":false},{"name":"ITIL","optional":false},{"name":"Windows Server","optional":false}],"status":"live","first_seen_at":"2026-08-11T00:00:00Z","employer_posted_date":"2026-08-11","last_verified_at":"2026-10-15T21:08:09Z","board_verified":true,"closed_at":null,"days_open":65,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":65},"description":"At Armanino, you determine your career path. This means it's possible to pursue challenges you are passionate about, in industries you care about.\nArmanino (USA) is proud to be among the top 20 Largest Firms in the United States of America and one of the Best Places to Work. Armanino (USA) has more than 2500 employees across the USA and more than 20 offices in different states of the USA. We have a community of resources that are ready and willing to support your ideas, build your skills and expand your professional network. We want you to integrate all aspects of your life with your career. At Armanino, we know you don’t check-out of life when you check-in at work. That’s why we’ve created a unique work environment where your passions, work, and family & friends can overlap. We want to help you achieve growth by giving you access to a network of smart and supportive people, willing to listen to your ideas.\nThis open position is for Armanino India LLP, which is located in India. Armanino India LLP is a fully owned subsidiary of Armanino (USA).\nResponsibilities\nSupport the India-based Infrastructure and Cybersecurity Operations Team responsible for day-to-day cybersecurity monitoring and operational response \nMonitor security, identity, endpoint, cloud, email, and infrastructure alerts according to assigned responsibilities and defined procedures \nTake ownership of assigned tickets, alerts, escalations, and follow-up items through resolution or proper handoff \nMaintain clear daily visibility into open work, aging issues, blockers, and items requiring escalation \nEscalate risks, blockers, recurring issues, and operational gaps to team leadership and New York-based teams \nTriage and support cybersecurity incidents across identity, endpoint, cloud, email, network, infrastructure, and collaboration environments \nFollow approved security runbooks for investigation, validation, documentation, response, containment support, and escalation \nSupport response for security-impacting issues and communicate status clearly \nPartner with New York-based cybersecurity, infrastructure, platform, and engineering teams on escalated security issues \nRespond to security escalations with extreme urgency and ensure issues are followed through to resolution or proper handoff \nIdentify repeat security issues and recommend process, monitoring, automation, or control improvements \nPerform initial review, triage, documentation, and escalation of cybersecurity alerts from security, identity, endpoint, cloud, email, and monitoring platforms \nEnsure alert handling follows approved security runbooks and escalation paths \nCoordinate with cybersecurity, compliance, infrastructure, and cloud teams on incidents that require deeper investigation or escalation \nTrack assigned alert activity, response notes, handoffs, and follow-up actions \nRaise patterns, control gaps, and recurring alert issues to New York-based leadership \nEnsure all cybersecurity alerts, incidents, and escalations are handled according to defined security runbooks \nMaintain consistency in ticket documentation, alert notes, handoffs, and escalation summaries \nReview runbook gaps and recommend updates based on recurring operational issues \nUnderstand expected response steps, communication standards, escalation thresholds, and documentation requirements \nDrive a culture of repeatable execution, ownership, and follow-through \nMaintain clear communication with team leadership, the Director of Core Technology in New York, and New York-based Core Technology and cybersecurity teams on assigned alerts, incidents, escalations, and operational priorities \nProvide concise status updates on active incidents, alerts, risks, and follow-up actions \nWork directly with New York-based teams to ensure clean handoffs, shared visibility, and consistent ownership \nParticipate in regular operational reviews, escalation discussions, and planning sessions with U.S.-based leadership \nEnsure availability to work with New York-based teams until at least 12:00 PM Eastern Time \nTake extreme ownership of assigned responsibilities, tickets, alerts, monitoring tasks, and escalations \nOperate as a self-starter who identifies issues, takes action, improves monitoring visibility, and drives work forward without waiting for step-by-step direction \nMaintain strong documentation, clear handoffs, and consistent follow-through on all assigned work \nWork with urgency on escalations, incidents, alerts, and time-sensitive operational issues \nRaise blockers, capacity concerns, skill gaps, and improvement opportunities to team leadership early \nRequirements\n4+ years in cybersecurity operations, security monitoring, incident response support, infrastructure operations, cloud operations, systems administration, or related technology operations role \nHands-on experience supporting security monitoring, alert triage, incident response workflows, ticketing, documentation, and escalation processes \nExperience managing cybersecurity escalations, monitoring alerts, incident response support, and operational handoffs \nExperience working with U.S.-based or global technology teams \nExperience operating in a structured runbook, ticketing, monitoring, and escalation environment \nCybersecurity operations across identity, endpoint, cloud, email, network, infrastructure, and collaboration platforms \nCybersecurity monitoring concepts, alert triage, escalation handling, and incident documentation \nMonitoring and alerting tools, ticketing systems, dashboards, and operational reporting \nConsistent hands-on work with monitoring solutions to improve visibility, alert quality, response accuracy, and operational follow-through \nMicrosoft security, identity, endpoint, Microsoft 365, Azure, Windows Server, Active Directory, and network security fundamentals \nIncident management, problem management, change awareness, and operational handoff practices \nRunbook execution, process documentation, escalation procedures, and service operations discipline \nStrong individual ownership, accountability, prioritization, and workload management skills \nClear, concise communication with New York-based leadership and cross-functional teams \nExcellent verbal and written communication skills with the ability to keep leadership informed during active issues, escalations, and operational handoffs \nStrong judgment on when to resolve, escalate, or request additional support \nAbility to manage multiple operational priorities while maintaining accuracy and urgency \nExtreme ownership mindset with strong documentation, follow-through, accountability, and attention to detail for all assigned responsibilities \nSelf-starter who can identify issues, take action, improve monitoring coverage, and drive work forward without waiting for step-by-step direction \nDemonstrates extreme urgency when responding to escalations, alerts, incidents, and time-sensitive operational issues \nAvailability to overlap with New York-based teams through at least 12:00 PM Eastern Time \nExperience working on an offshore or India-based technology operations team supporting U.S. stakeholders \nExperience in professional services, consulting, financial services, or other high-accountability enterprise environments \nExperience with Microsoft security, endpoint, identity, and cloud operations tools \nExperience improving runbooks, alert tuning, dashboards, or operational reporting \nITIL, SOC, NOC, or service operations background \nCertifications: Security+, SC-900, AZ-900, AZ-500, Microsoft security certifications, ITIL Foundation, Network+, or equivalent \nCompensation and Benefits\nCompensation: Commensurate with Industry standards\nOther Benefits: Provident Fund, Gratuity, Medical Insurance, Group Personal Accident Insurance etc. employment benefits depending on the position.\n\"Armanino” is the brand name under which Armanino LLP, Armanino CPA LLP, and Armanino Advisory LLC, independently owned entities, provide professional services in an alternative practice structure in accordance with law, regulations, and professional standards. Armanino LLP and Armanino CPA LLP are licensed independent CPA firms that provide attest services, and Armanino Advisory LLC and its subsidiary entities provide tax, advisory, and business consulting services. Armanino Advisory LLC and its subsidiary entities are not licensed CPA firms.\nArmanino provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Armanino complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.\nArmanino expressly prohibits any form of workplace harassment based on race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, genetic information, disability, or veteran status. Improper interference with the ability of Armanino employees to perform their job duties may result in discipline up to and including discharge.\nWe have a community of resources that are ready and willing to support your ideas, build your skills and expand your professional network.","description_format":"text","description_chars":9469,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-15T12:12:28Z"}],"visa":[],"liveness":{"score":10,"band":"cold","label":"Long shot","p_open":1,"p_active":0.363,"p_room":0.28,"age_days":65,"expected_fill_days":20,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-10-15T22:48:52Z"},"pay":null,"html_url":"https://alion.io/job/armanino-cybersecurity-operations-engineer","json_url":"https://alion.io/job/armanino-cybersecurity-operations-engineer.json","meta":{"generated_at":"2026-10-15T22:48:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":34645,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4417640},"rest":"https://alion.io/mcp/rest/get_company?id=4417640"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farmanino-cybersecurity-operations-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farmanino-cybersecurity-operations-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farmanino-cybersecurity-operations-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/armanino-cybersecurity-operations-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farmanino-cybersecurity-operations-engineer"}]}