{"id":2925059,"url":"https://alion.io/job/larsen-toubro-sr-soc-engineer-l3","title":"Sr. SOC Engineer (L3)","company":{"id":2124,"name":"Larsen & Toubro","domain":"larsentoubro.com","url":"https://alion.io/company/larsentoubro","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Career site","truth_index":{"grade":"B","score":75,"open_postings":24,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":25,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Hardware","role_family":"Hardware","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chennai, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":15000,"max_usd":40000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":18},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Clair","optional":false},{"name":"Crowdstrike","optional":false},{"name":"CUDA","optional":false},{"name":"CyberArk","optional":false},{"name":"Defense in Depth","optional":false},{"name":"DLP","optional":false},{"name":"GCP","optional":false},{"name":"HashiCorp Boundary","optional":false},{"name":"IAM","optional":false},{"name":"IBM QRadar","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SBOM","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Trivy","optional":false},{"name":"Vault","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-10-14T00:00:00Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-11-01T15:17:11Z","board_verified":true,"closed_at":null,"days_open":18,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":18},"description":"Job Purpose\nThe SOC L3 acts as the Senior technical escalation point within the SOC, leading threat hunting, advanced incident investigations, security engineering improvements, and strategic cyber defence initiatives. Protect multi tenant GPU cloud with defense in depth, ensuring zero trust, auditability, and regulatory alignment.\nRole Description\nKey Responsibilities\nLead investigation of sophisticated cyber attacks and advanced persistent threats (APTs).\nPerform proactive threat hunting across enterprise environments.\nDevelop advanced detection engineering use cases.\nDesign and optimize SIEM, SOAR, XDR, and cloud security monitoring capabilities.\nConduct forensic investigations across endpoints, networks, cloud, and identity platforms.\nDevelop incident response playbooks and automation workflows.\nLead post-incident reviews and lessons-learned sessions.\nProvide security recommendations to architecture and engineering teams.\nMentor SOC L1/L2 analysts and support career development.\nCoordinate with Threat Intelligence and Red Team functions.\nSupport security audits, compliance, and executive reporting.\nON-CALL Support for L2/L1 support team.\nImplementation\noEnforce IAM/RBAC, least privilege, and network micro segmentation; secrets/KMS integration.\noDefine secure baselines for OS, containers, CUDA drivers, and platform services; supply chain controls (image signing/SBOM).\noImplement and management experience of cloud network security controls such as security groups, firewalls, WAF, DDoS, micro-segmentation, EDR, DLP, PIM/PAM and secure connectivity etc\nOperations\noContinuous vulnerability management, patch cadence, threat detection (EDR/XDR), and audit log integrity.\noPeriodic access reviews, key rotation, and compliance evidence packs.\nReliability & Incident\noIncident response (containment/forensics/eradication); purple team exercises; tabletop drills.\nData Protection\noEncryption in transit/at rest, tenant isolation boundaries, data retention, legal holds, and purge workflows.\nExperience & Educational Requirements\nQualifications and Experience\nEDUCATIONAL QUALIFICATIONS: (degree, training, or certification required)\nBE/B-Tech or equivalent with Computer Science or Electronics & Communication\nRELEVANT EXPERIENCE: (no. of years of technical, functional, and/or leadership experience or specific exposure required)\n8-15 years cybersecurity; strong cloud security, zero trust, and data privacy in regulated environments.\nDeep expertise in Sentinel, Splunk, QRadar, Chronicle, or equivalent SIEM platforms.\nAdvanced knowledge of Microsoft Defender XDR, Defender for Cloud, CrowdStrike, SentinelOne, and other XDR solutions.\nStrong threat hunting expertise using MITRE ATT&CK framework.\nExpertise in cloud security (Azure, AWS, GCP).\nDigital forensics and malware reverse engineering knowledge.\nSecurity automation using Python, PowerShell, Logic Apps, SOAR platforms.\nDetection engineering and threat modeling skills.\nKnowledge of Zero Trust Architecture and Identity Security.\nAbility to lead major security incidents and crisis management efforts.\nExperience with Active Directory, Microsoft Entra ID, CyberArk, or enterprise PAM solutions.\nExperience with NIST CSF, NIST 800-61, MITRE, CIS Controls, and ATTACK evaluations.\nExperience building SOC metrics, executive dashboards, and reporting for senior leadership.\nExperience with security architecture reviews and cloud landing zone security.\nInvestigate advanced identity-based attacks involving Active Directory, Microsoft Entra ID, PAM, IAM, Kerberos, and hybrid identity environments.\nLead investigations involving Kubernetes, container runtime, virtualization platforms, and GPU infrastructure security.\nTools / Tech\nSIEM (Splunk/ELK), EDR/XDR, image scanners (Trivy/Clair), OPA/Gatekeeper, Vault/KMS/HSM, HashiCorp Boundary (or equivalent), NVIDIA DCGM, NVIDIA BCM, Firewalls, DDOS, WAF, LB, VAM, PAM\nCertifications\nCISSP; CISM/CISA; CCSP; ISO 27001 Lead Implementer/Auditor, GCFA, GCTI, CISSP, CCSP, AZ-500, SC-100, SC-200, GIAC Certifications, Microsoft Cybersecurity Architect Expert, Kubernetes Security Specialist.\nKPIs\nMean time to detect/respond, vulnerability backlog burn down, audit non conformities, policy violation rate.","description_format":"text","description_chars":4230,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Civil & Structural Engineering","Engineering Services","Construction"],"lifecycle":[{"event":"open","at":"2026-10-20T13:16:04Z"}],"visa":[],"liveness":{"score":45,"band":"ok","label":"Likely open","p_open":1,"p_active":0.606,"p_room":0.75,"age_days":18,"expected_fill_days":25,"reasons":["conf:3","stale_co","velocity","win:late","comp:brand"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/larsen-toubro-sr-soc-engineer-l3","json_url":"https://alion.io/job/larsen-toubro-sr-soc-engineer-l3.json","meta":{"generated_at":"2026-11-01T18:37:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28460,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2124},"rest":"https://alion.io/mcp/rest/get_company?id=2124"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flarsen-toubro-sr-soc-engineer-l3"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flarsen-toubro-sr-soc-engineer-l3"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flarsen-toubro-sr-soc-engineer-l3"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/larsen-toubro-sr-soc-engineer-l3\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flarsen-toubro-sr-soc-engineer-l3"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2925059}},{"tool":"search_jobs","arguments":{"company":"larsentoubro.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2925059},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}