{"id":3812064,"url":"https://alion.io/job/zeta-analyst-ii-siemsecops","title":"Analyst II - SIEM/SecOps","company":{"id":95345,"name":"Zeta","domain":"zeta.tech","url":"https://alion.io/company/zeta-tech","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":70,"open_postings":22,"ghost_share":0.5,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":45,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"Cloudflare","optional":false},{"name":"DNS","optional":false},{"name":"IAM","optional":false},{"name":"Jira","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OpenSearch","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"TheHive","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-08T11:21:01Z","employer_posted_date":"2026-09-08","last_verified_at":"2026-11-09T09:35:41Z","board_verified":true,"closed_at":null,"days_open":62,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":61},"description":"About us:\nBuild the future of banking.\n\nZeta is a next-generation banking technology company providing cloud-native, fully stackable processing and core banking platforms for issuers. With a focus on scalability, compliance, and innovation, Zeta empowers financial institutions to modernize their technology infrastructure and deliver secure, seamless digital banking experiences.\nOur impact runs at real-world scale. Today, over 25 million cards are live on Zeta-powered platforms across 7 countries, supported by a passionate team of 1,700+ Zetanauts across India, the US, EMEA, and Asia. Backed bySoftBank Vision Fund, Mastercard, and other reputed strategic investors, we reached a valuation of $2 billion in 2025.\nOur focus is on establishing product lines that focus on key outcomes by addressing real customer pain points, modernizing legacy systems, and strengthening core fundamentals. As a result, our systems and platforms support a wide range of banking and payments capabilities, including:\n1. Tachyon, our cloud-native banking stack built for population-scale systems\n2. Cipher, our unified authentication platform for secure, high-volume banking environments\n3. Digital Credit as a Service, enabling banks to launch credit lines on UPI\n4.Elena, our intelligent and conversational AI platform for banking\n5. Pixel, India’s first digital-native credit card, launched in partnership with HDFC Bank, for whom we also revamped their PayZapp mobile app: Winner of the Celent Model Bank Award for Payments Innovation 2024\n6. Sparrow, the leading card experience for non-prime cardholders in the US\n…and more across cards, payments, lending, and core banking.\nWe are an engineering-first organization that values ownership, bias for action, and long-term thinking. Together, we solve some of the hardest problems in banking tech. Our culture is built around trust, collaboration, and creating the conditions for you to drive impact proportionate to your potential. Reinforcing our commitment to creating an inclusive and supportive workplace, we have been consistently recognized as a Great Place to Work.\nIf you want to build cutting-edge banking tech that enables banks to serve millions reliably, securely, and at a population scale, Zeta is your playground.\nIf you would like to learn more about how we have grown and evolved over the years, watch our journey here. You can also explore our website and follow us on LinkedIn,Instagram,YouTube, andX.\nAbout the Role:\nZeta is building out its Security Operations Centre function, running on AWS OpenSearch as our core SIEM. We are looking for a SOC L2 Analyst with a strong investigative mindset and hands-on comfort operating without a traditional GUI-driven workflow - this role requires fluency in query languages to search, correlate, and triage data directly.\nYou'll be one of the early analysts shaping detection and response practices across a modern, cloud-native, hybrid environment spanning Kubernetes microservices, multi-cloud infrastructure, and traditional corporate IT.\nYou will be investigating and monitoring across:\n Cloud & Infrastructure: AWS (primary hosting for all workloads/resources), Azure (logs), Kubernetes microservices\nEdge/CDN & Network Security: Cloudflare\n Endpoint: Microsoft Defender (corporate IT), macOS endpoints\n Primary OS for incidents: Linux (majority of incident volume), with Windows/macOS corporate IT coverage\n SIEM: AWS OpenSearch (query-language driven - no dedicated analysis GUI)\nResponsibilities:\n1. Monitoring & Escalation Handling\nPerform full-time monitoring alongside L1, actively working the alert queue during high-volume periods, while also handling escalations from L1 analysts.\nAct as the primary escalation point for all L1-escalated alerts and incidents; receive and validate escalated alerts/incidents, performing deeper investigation to confirm scope, impact, and root cause.\nPerform detailed investigation, log correlation, and root-cause analysis across multiple data sources - AWS, Kubernetes, Cloudflare, Azure logs, Defender, and Linux/macOS endpoints.\nWrite and run OpenSearch Query DSL / Lucene queries directly against raw log data to pivot, correlate, and build full incident timelines (this is the primary analysis method - there is no GUI-driven investigation path).\nDetermine incident severity, scope, and business impact; validate true positive vs. false positive at a deeper level.\nEscalate confirmed major/high-severity incidents to the L3/Incident Response team or CSIRT leadership per the incident response plan, including a full technical summary, supporting evidence, and recommended actions.\nCoordinate with L3/Incident Response teams for complex or high-severity incidents.\n2. Threat Analysis & Detection Support\nConduct threat hunting based on IOCs, IOAs, and threat intelligence feeds.\nSupport ideation and testing of new detection use cases, correlation rules, and dashboards, in coordination with the detection engineering/L3 team.\nIdentify and report logging/health issues (e.g., missing logs, parser errors, data source outages) for timely resolution.\nTune and recommend improvements to detection rules, correlation logic, and SIEM use cases based on false positives/negatives observed during investigations; develop tested tuning solutions and hand them to L3 analysts and build teams for deployment.\nCreate new detection use cases, tune existing correlation rules, build/modify dashboards, develop and refine UEBA rules, and map detections to the MITRE ATT&CK framework for coverage visibility.\n3. Playbook, SOP & Knowledge Management\nDevelop and refine investigation steps for scenarios not covered by existing playbooks, and document these as new/updated runbooks for L1 use.\nUpdate and improve SOPs, playbooks, and knowledge base articles based on incident learnings.\n4. L1 Oversight & Mentoring\nMentor and provide technical guidance to L1 analysts, including alert triage decisions and use of investigation tools.\nOwn L1 shift handovers, and train/mentor L1 analysts on alert handling and escalation.\nReview quality of L1 alert closures and escalations; provide feedback and coaching.\nSupport training and onboarding of L1 analysts on tools, triage procedures, and escalation criteria.\nEnsure smooth shift handovers between L1 and L2, and across shifts.\n5. Compliance & Audit Support\nAssist with compliance and audit requests requiring deeper technical evidence or investigation summaries.\n6. Continuous Learning & Feedback\nContinuously expand knowledge of emerging threats, attack techniques, and best practices through ongoing training and self-study.\nStay current on emerging threats, TTPs, and vulnerabilities relevant to our environment, and translate this into actionable detection improvements.\nSkills:\nStrong working knowledge of SIEM query languages - direct experience with OpenSearch Query DSL, Lucene syntax, KQL, SPL, or equivalent is essential (you must be comfortable querying raw data without relying on prebuilt dashboards)\nSolid Linux investigation skills - process, network, and log-level analysis on Linux hosts is core to this role\nPractical understanding of cloud security fundamentals, ideally AWS (IAM, CloudTrail, VPC Flow Logs, GuardDuty, etc.)\nExposure to Kubernetes/container security concepts (pod logs, k8s audit logs, common container attack patterns)\nFamiliarity with Cloudflare logs (WAF, DNS, edge traffic) or similar CDN/edge security tooling\nWorking knowledge of Microsoft Defender and basic Windows/macOS endpoint investigation\nStrong analytical and investigative mindset - able to pivot from a single alert to a full incident narrative using raw log data\nUnderstanding of the MITRE ATT&CK framework and common attack patterns (cloud, container, endpoint), including mapping detections for coverage visibility\nExperience acting as an escalation point for L1 analysts - validating their triage, coaching on quality, and owning shift handovers\nAbility to author and maintain runbooks, SOPs, and knowledge base articles from incident learnings\nClear, structured incident documentation and communication skills\nExperience and Qualifications:\n3-5 years of hands-on SOC experience, with at least 1-2 years in an L2 analyst capacity handling escalations independently\nBachelor of Technology (BE/B.Tech), M.Tech/ME in Computer Science or equivalent.\nPrior SOC experience in a fintech, banking, or regulated industry environment\nExposure to Azure Sentinel/Azure logs in addition to AWS\nScripting ability (Python, Bash) for automation of repetitive investigation tasks\nCertifications such as Security+, GCIH, GCIA, CySA+, or equivalent\nExperience contributing to detection engineering (writing/tuning correlation rules, not just consuming them)\nFamiliarity with case management/ticketing tools (e.g., TheHive, Jira, ServiceNow)\nExperience developing or tuning UEBA rules\nExperience identifying and reporting log pipeline health issues (missing sources, parser errors, ingestion outages)\nExperience supporting compliance/audit evidence requests (PCI-DSS, SOC 2, RBI/regulatory - relevant to fintech)","description_format":"text","description_chars":9081,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Cards & Card Issuing","Financial Software & Embedded Finance"],"lifecycle":[{"event":"open","at":"2026-11-05T14:57:31Z"}],"visa":[],"liveness":{"score":24,"band":"cold","label":"Long shot","p_open":1,"p_active":0.535,"p_room":0.44,"age_days":61,"expected_fill_days":45,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:"],"computed_at":"2026-11-09T06:03:00Z"},"pay":null,"html_url":"https://alion.io/job/zeta-analyst-ii-siemsecops","json_url":"https://alion.io/job/zeta-analyst-ii-siemsecops.json","meta":{"generated_at":"2026-11-09T11:45:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13992,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":95345},"rest":"https://alion.io/mcp/rest/get_company?id=95345"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fzeta-analyst-ii-siemsecops"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fzeta-analyst-ii-siemsecops"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fzeta-analyst-ii-siemsecops"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/zeta-analyst-ii-siemsecops\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fzeta-analyst-ii-siemsecops"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3812064}},{"tool":"search_jobs","arguments":{"company":"zeta.tech","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3812064},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}