{"id":2704395,"url":"https://alion.io/job/novartis-assoc-dir-ddit-isc-csoc-engineering-cloud","title":"Assoc. Dir. DDIT ISC CSOC Engineering - Cloud","company":{"id":5824,"name":"Novartis","domain":"novartis.com","url":"https://alion.io/company/novartis","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":85,"open_postings":65,"ghost_share":0,"stale_share":0.569,"repost_share":0.031,"time_to_fill_p50_days":35,"computed_at":"2026-10-21T05:46:15Z"}},"role":"DevOps","role_family":"DevOps","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":21000,"max_usd":43000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":49},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"Amazon CloudWatch","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bicep","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"Git","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Terraform","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-10-16T12:09:31Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-21T21:21:08Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"Job Description Summary\nWe are seeking a hands-on Cloud Detection Engineer to help shape the future of cloud security monitoring at Novartis. You will design, build, validate and continuously improve detection capabilities across Azure, AWS and other strategic cloud platforms while being a key partner with incident response and cloud security architect teams. An engineering role that combines cloud telemetry, custom detections, threat research, automation and AI-assisted investigation to create high-signal, scalable outcomes for Cyber Defense.Role purpose:\nBuild a robust, AI-native cloud detection pipeline that improves correlation and investigation efficiency across multi-cloud environments. Engineer fragmented cloud telemetry into clear, actionable security outcomes with AI embedded throughout the detection engineering lifecycle. A multidimensional engineering role at the intersection of automation, cloud architecture, threat behavior analysis, detection engineering supporting analyst investigation workflows. \nJob Description\nKey Responsibilities\n\nDesign and operate an AI-native cloud detection pipeline that aggregates, correlates, enriches, deduplicates and prioritizes signals before analyst investigation\nBuild and tune high-fidelity detections that improve coverage across cloud control-plane, data plane and management-plane activity, identity and access, network, container and Kubernetes and security posture.\nUse lower-fidelity and behavioral signals as investigation context, while ensuring known high-confidence detections are consistently escalated for security investigation\nIntegrate and correlate telemetry from WIZ, Microsoft Defender for Cloud, AWS GuardDuty, Microsoft Sentinel and other cloud-native or CNAPP sources . Apply hands-on Wiz experience to interpret posture findings, attack paths, identity and exposure context, cloud events, runtime findings and threat detections and improve detection workflows\nDevelop behavioral baselines and entity-centric analytics across users, IP addresses, identities and cloud resources . Create reusable dashboards, dynamic lookups and enrichment patterns enabling rapid pivots / drilldowns from an alert to related resource, identity, inventory and historical data\nOwn the detection lifecycle from threat hypothesis and telemetry assessment through development, peer review, testing, deployment, tuning, documentation and retirement\nEmbed AI across the detection lifecycle to accelerate detection creation and tuning, while ensuring engineering controls and human judgment govern the outcomes\nFinetune detections using historical data, controlled simulations, purple-team exercises, attack emulation and lessons learned from incidents and threat hunts\nUse detection-as-code practices, Git, CI/CD and automated testing to deliver controlled, repeatable and auditable content changes . Partner with Threat Hunting and Response, CSOC analysts, cloud platform teams, data onboarding, threat intelligence and automation teams to close visibility gaps and operationalize detections\nAutomate enrichment and triage using Python, APIs, SOAR workflows and AI-assisted approaches, with appropriate human oversight for security decisions . Measure and improve detection coverage, precision, false-positive rate, investigation volume, alert latency, data quality and analyst effort\nRequired Qualifications\n8+ years of hands-on experience in cloud security, detection engineering, security analytics, threat hunting, incident response or security platform engineering\nWorking knowledge of Azure and AWS security architectures, respective cloud domains and workloads\nUnderstanding of cloud telemetry and logging sources such as Azure Activity and Diagnostic logs, Entra ID logs, AWS CloudTrail, AWS CloudWatch and GuardDuty findings\nExperience in working with CNAPP bundles or developing and tuning detections in Wiz, Vega or cloud-native security platforms\nProficiency in KQL and at least one scripting or programming language such as Python. CloudShell understanding is expected\nFamiliarity with AI/LLM-assisted security investigation, agentic workflows or machine-learning approaches to signal enrichment and triage . Understanding of MITRE ATT&CK, MITRE ATLAS, threat-informed defense, entity mapping, correlation, enrichment and alert prioritization\nAbility to investigate complex datasets, distinguish true security risk from operational noise and communicate engineering decisions clearly . Experience collaborating across security operations, cloud engineering and platform teams in a global environment.\nExperience with detection-as-code, Sigma or YAML-based content, Git, CI/CD, unit/integration testing and safe deployment or rollback practices . Experience with Infrastructure as Code and automation tools such as Terraform, ARM/Bicep, CloudFormation or equivalent. Background in threat intelligence, purple teaming, red teaming, incident response or cloud threat research\nDesirable Requirement:\nRelevant certifications such as AZ-500, AWS Certified Security - Specialty, GIAC Cloud Security certifications, CCSP or equivalent practical expertise.\nGIAC Cloud Forensics Responder (GCFR) \n\nYou’ll receive: You can find everything you need to know about our benefits and rewards in the Novartis Life Handbook. https://www.novartis.com/careers/benefits-rewards\nCommitment to Diversity and Inclusion: \nNovartis is committed to building an outstanding, inclusive work environment and diverse teams' representative of the patients and communities we serve.\nJoin our Novartis Network: If this role is not suitable to your experience or career goals but you wish to stay connected to hear more about Novartis and our career opportunities, join the Novartis Network here: \nhttps://talentnetwork.novartis.com/network\nSkills Desired\nCommunication, Cybersecurity Compliance, Cyber Threat Hunting, Cyber Threat Intelligence, Cyber Threat Prevention, Decision Making, Digital Capabilities, Influencing Skills, Information Security Risk Management, Technology Use, Vulnerability Management","description_format":"text","description_chars":6050,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Oncology Therapeutics","Neurology & CNS Therapeutics","Immunology & Inflammation Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-16T12:09:31Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":4,"expected_fill_days":35,"reasons":["conf:1","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/novartis-assoc-dir-ddit-isc-csoc-engineering-cloud","json_url":"https://alion.io/job/novartis-assoc-dir-ddit-isc-csoc-engineering-cloud.json","meta":{"generated_at":"2026-10-21T23:07:39Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32889,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5824},"rest":"https://alion.io/mcp/rest/get_company?id=5824"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnovartis-assoc-dir-ddit-isc-csoc-engineering-cloud"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnovartis-assoc-dir-ddit-isc-csoc-engineering-cloud"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnovartis-assoc-dir-ddit-isc-csoc-engineering-cloud"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/novartis-assoc-dir-ddit-isc-csoc-engineering-cloud\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnovartis-assoc-dir-ddit-isc-csoc-engineering-cloud"}]}