Information Security Specialist

This is a hands-on Information Security Operations role that combines SOC monitoring and investigation with Vulnerability Assessment and Penetration Testing (VAPT) execution.

The individual triages and investigates SOC alerts while also running vulnerability scans, web/API security testing, and SAST/DAST review with remediation tracking through to closure.

This is not a GRC analyst position; compliance or audit involvement is limited to providing accurate evidence from SOC and VAPT activities.

Principle Accountabilities (Key Result Areas) :

Job Description :

Core responsibilities across SOC monitoring, VAPT execution, and evidence management include the following :

- Monitor SOC queues and investigate alerts from Managed SOC/SIEM, endpoint, identity, email-security, DLP, VPN/proxy and endpoint-compliance sources.

- Enrich SOC alerts using user, device, IP, ASN, geo-location, application, timestamp, IOC, endpoint posture, related tickets and historical evidence.

- Document investigations with working notes, screenshots, containment status, closure rationale, ticket updates and shift handover notes.

- Execute scheduled and ad hoc vulnerability scans for infrastructure and applications; validate findings before escalation.

- Perform web application and API security testing under defined scope; mobile application testing is excluded unless separately assigned in the future.

- Review SAST/DAST findings, assist with secure-code review and coordinate with application/development owners for remediation evidence.

- Track vulnerability remediation and retesting in ServiceNow or approved workflow tools; maintain clean closure, retest and exception evidence.

- Support containment actions including account disablement, device freeze/quarantine/isolation, suspicious-session review, user outreach and restoration evidence.

- Prepare SOC monitoring inputs and VAPT status inputs including open vulnerabilities, overdue remediation, retest outcomes, repeat findings and escalation items.

- Provide security evidence from SOC/VAPT work when requested for audit/client/security review; do not own GRC program activities.

- Ensure SOC alerts are triaged consistently with evidence, classification, escalation notes and closure rationale (success measure).

- Validate, document and track infrastructure, web/API and SAST/DAST findings through remediation or retest (success measure).

- Escalate high-risk identity, endpoint, email, DLP, vulnerability and VPN/proxy events without delay (success measure).

- Maintain ServiceNow/security tickets that are complete, evidence-backed and aligned to SOC/VAPT operating expectations (success measure).

Attributes & Attitude :

- Hands-on investigative mindset with the discipline to perform practical triage and testing, not only ticket monitoring or scanner-output forwarding.

- Strong escalation discipline - knows when and how to escalate to Consultant/InfoSec lead, IT Ops, GSD, Endpoint, Development, HR/Ops, TAM or Legal based on severity and impact.

- Meticulous evidence and retesting hygiene, consistently capturing screenshots, timestamps, tool outputs, reproduction steps and closure comments.

- Clear, business-formal written communication for incident notes, vulnerability findings, remediation follow-ups and shift handovers.

- Comfortable operating across a hybrid scope - balancing SOC alert response with VAPT execution within the same role.

- Collaborative approach when coordinating with application/development owners, IT Ops and cross-functional teams on remediation evidence.

- Ownership and accountability for closure quality, without extending into GRC program ownership.

- Adaptable and detail-oriented, able to brief a Consultant/InfoSec lead with concise facts and risk indicators.

Knowledge :

Qualifications :

Minimum 3 - 5 years of experience and working knowledge across the following areas :

- SOC Operations: 3 - 5 years in SOC, MDR, InfoSec operations, endpoint security, vulnerability management or security monitoring support; BPO, healthcare, PCI or client-regulated environment exposure preferred.

- Vulnerability Assessment: Ability to run scans, validate vulnerabilities, capture evidence, prepare remediation notes and support retesting; Nessus/Qualys/OpenVAS and ServiceNow remediation tracking experience preferred.

- Web/API Testing: Working knowledge of OWASP Top 10, web/API testing methodology and manual validation using Burp Suite or OWASP ZAP; experience preparing concise technical finding write-ups preferred.

- SAST/DAST/Code Review: Ability to review tool findings, understand vulnerable code patterns and coordinate with developers under senior guidance; familiarity with SonarQube, Snyk, Semgrep, Checkmarx, Veracode or Fortify preferred.

- Communication and Evidence: Clear business-formal writing for incident notes, vulnerability findings, remediation follow-ups and shift handovers; able to brief a Consultant/InfoSec lead with concise facts and risk indicators.

- SIEM/MDR Tooling: Arctic Wolf/Aurora, Microsoft Sentinel or equivalent SIEM, Splunk/QRadar fundamentals, ServiceNow ticketing and IOC enrichment workflows.

- Identity/Endpoint Tooling: Microsoft Entra ID, Conditional Access, MFA, Defender for Endpoint, FortiEDR, Absolute, Intune/JamF, BitLocker/FileVault and endpoint evidence capture.

- Email/DLP Tooling: Abnormal AI / O365 email security, Microsoft Purview DLP, phishing/BEC/ATO investigation queues and remediation evidence.

- Network Vulnerability Tools: Nessus, Qualys, OpenVAS, Nmap, basic Metasploit validation, Wireshark and SSL/TLS testing tools.

- AD/Windows Exposure Awareness: BloodHound, PingCastle and NetExec/CrackMapExec awareness for privilege path, misconfiguration and exposure validation under supervision.

- Web/API Testing Tools: Burp Suite, OWASP ZAP, Postman, API collections and manual validation for authentication, authorization, session and input-handling issues.

- SAST Tools: Checkmarx, Veracode, SonarQube, Fortify, Snyk, Semgrep or equivalent; ability to read code paths and identify likely vulnerable patterns.

- DAST Tools: Burp Suite, OWASP ZAP, Acunetix, Invicti/Netsparker, AppScan or equivalent; validate output before raising remediation tickets.

- Cloud Security Basics: Microsoft Defender for Cloud / Azure posture review basics, AWS exposure awareness, Prowler/ScoutSuite-style output interpretation where applicable.

- Connectivity Context: FortiSASE, FortiGate, VPN, IPQS/IP2Proxy or equivalent tools for VPN/proxy/geolocation validation.

- Desirable Certifications: eJPT / PNPT / CEH Practical, CompTIA PenTest+ / Security+ / CySA+, Burp Suite certification or web testing training, Splunk Core / SIEM fundamentals - all Good to Have.

Skills

Information Security, IT Security Strategy, Security Operations Center, VAPT, Vulnerability Management, DAST, SAST, Network Security, DLP, OWASP