{"id":3517436,"url":"https://alion.io/job/blackline-security-operations-center-analyst","title":"Security Operations Center Analyst","company":{"id":1833518,"name":"BlackLine","domain":"blackline.com","url":"https://alion.io/company/blackline-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":42,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":11500,"max_usd":33000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":623},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DLP","optional":false},{"name":"DNS","optional":false},{"name":"Falcon","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"LLM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Prompt Engineering","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false},{"name":"Wireshark","optional":false}],"status":"live","first_seen_at":"2026-10-30T10:57:11Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-10-30T16:06:34Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Make Your Mark:\nReporting to the Senior Director of Information Security, the Security Operations Center (SOC) Analyst will play a vital frontline role in monitoring, detecting, analyzing, and responding to cyber threats and security incidents across BlackLine. In this role, you will participate in operational shift/on-call coverage, monitor and triage security alert queues, investigate potential security events, execute incident containment procedures, assist with vulnerability management workflows, collaborate with cross-functional engineering and IT teams, and contribute to the continuous enhancement of BlackLine’s enterprise security posture.You'll Get To:\nParticipate in a 'follow-the-sun' operational monitoring schedule, acting as a primary responder to actively monitor, triage, and manage the real-time security alerts queue across global environments.\nBridge the gap between detection and remediation by executing and refining standard operating procedures (SOPs), manual runbooks, and automated playbooks needed to handle threats and eliminate false positives.\nPerform initial triage, scoping, and deep-dive investigation of security events and anomalous activities across endpoint, network, identity, and multi-cloud environments.\nApply a research-first mindset to threat analysis and incident handling, demonstrating the critical thinking needed to independently investigate alerts, trace attack lifecycles, and evaluate new security tools.\nOperationalize detection and response workflows through scripting and security orchestration (SOAR), leveraging automation to streamline repetitive alert triage and accelerate incident containment.\nMonitor and support the day-to-day operations of key SecOps technologies, including SIEM, Endpoint Detection and Response (EDR), Data Loss Prevention (DLP), and Web Application Firewalls (WAF).\nLeverage AI and LLMs to accelerate security alert analysis, synthesize threat intelligence, automate repetitive triage tasks, and drive operational efficiency across the SOC.\nFlex into evolving security initiatives and technical projects as they arise, taking proactive ownership of tasks that support detection engineering, threat hunting, and operational readiness.\nSupport vulnerability management functions by triaging vulnerability scan results, validating exploitability, and coordinating remediation tickets with system and application owners.\nCreate and maintain operational shift handoffs, incident summaries, and SOC metrics, translating raw event data into clear insights required for data-driven SecOps improvements.\nCollaborate closely with senior security engineers, infrastructure teams, and IT stakeholders to escalate verified incidents and promote security awareness and best practices across BlackLine.\nWhat You'll Bring:\n2+ years of hands-on experience in a Security Operations Center (SOC), security monitoring, or incident response role.\nPractical experience with enterprise SIEM platforms (e.g., Splunk, Microsoft Sentinel) and EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender), with the technical curiosity to investigate alerts across multi-cloud environments (AWS, Azure).\nStrong analytical, problem-solving, and investigative skills with the ability to correlate disparate log sources, identify malicious activity, and propose effective containment actions.\nHighly disciplined and dependable in fast-paced operational environments, with strong attention to detail and sound judgment during high-priority security incidents.\nProven ability to leverage scripting languages, such as Python, Bash, or PowerShell, to parse logs, query APIs, and automate routine security analysis tasks.\nWorking knowledge of Windows and Linux/Unix operating systems, including file systems, process execution, and system event logs (Event Viewer, syslog).\nWorking knowledge of network security fundamentals, including a solid understanding of the OSI model, TCP/IP, DNS, HTTP/S, common network protocols, and packet analysis tools (e.g., Wireshark).\nAdvanced written and verbal communication skills, including the ability to document clear incident timelines, author thorough ticket notes, and communicate technical findings to cross-functional teams.\nFamiliarity with common cyber attack vectors, MITRE ATT&CK framework, OWASP Top 10, and exploitation techniques to independently triage security findings.\n We’re Even More Excited If You Have:\nExperience triaging security alerts in containerized and Kubernetes environments.\nHands-on experience leveraging AI/LLM tools for security analysis, alert summarization, or prompt engineering in SOC workflows.\nRelevant industry certifications such as CompTIA Security+, CySA+, GIAC (GCIH, GCIA, GMON), or cloud security associate certifications (AWS, Azure).\nFamiliarity with Security Orchestration, Automation, and Response (SOAR) platforms and an outside-the-box mindset for proactively optimizing SOC workflows and hunting threats.\nThrive at BlackLine Because You Are Joining:\nA technology-based company with a sense of adventure and a vision for the future. Every door at BlackLine is open. Just bring your brains, your problem-solving skills, and be part of a winning team at the world's most trusted name in Finance Automation!\nA culture that is kind, open, and accepting. It's a place where people can embrace what makes them unique, and the mix of cultural backgrounds and varying interests cultivates diverse thought and perspectives.\nA culture where BlackLiner's continued growth and learning is empowered. BlackLine offers a wide variety of professional development seminars and inclusive affinity groups to celebrate and support our diversity.\nBlackLine is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity or expression, race, ethnicity, age, religious creed, national origin, physical or mental disability, ancestry, color, marital status, sexual orientation, military or veteran status, status as a victim of domestic violence, sexual assault or stalking, medical condition, genetic information, or any other protected class or category recognized by applicable equal employment opportunity or other similar laws.\nBlackLine recognizes that the ways we work and the workplace itself has shifted. We innovate in a workplace that optimizes a combination of virtual and in-person interactions to maximize collaboration and nurture our culture. Candidates who live within a reasonable commute to one of our offices will work in the office at least 3 days a week.\nAccommodations:\nBlackLine is committed to creating an inclusive and accessible experience for all candidates. If you require a reasonable accommodation that would better enable your success during the application or interview process, please complete this form.","description_format":"text","description_chars":6836,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Accounting & Tax Software"],"lifecycle":[{"event":"open","at":"2026-10-30T10:57:11Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":42,"reasons":["conf:4","win:early","comp:junior"],"computed_at":"2026-10-30T20:58:04Z"},"pay":null,"html_url":"https://alion.io/job/blackline-security-operations-center-analyst","json_url":"https://alion.io/job/blackline-security-operations-center-analyst.json","meta":{"generated_at":"2026-10-30T20:58:04Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11262,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1833518},"rest":"https://alion.io/mcp/rest/get_company?id=1833518"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fblackline-security-operations-center-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fblackline-security-operations-center-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fblackline-security-operations-center-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/blackline-security-operations-center-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fblackline-security-operations-center-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3517436}},{"tool":"search_jobs","arguments":{"company":"blackline.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3517436},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}