Everpure (NYSE: P) has evolved from storage pioneer to data platform, closing fiscal 2026 with $3.7 billion in revenue, its first billion-dollar quarter, and accelerating growth into FY27. Our strategic agenda spans the companies defining the next era of technology - hyperscalers, AI labs, the AI hardware supply chain, data platform providers, and the broader AI ecosystem.
This type of work—work that changes the world—is what the tech industry was founded on. So, if you're ready to seize the endless opportunities and leave your mark, come join us.
THE ROLE
You will own the security operations tempo for the Bengaluru shift: orchestrating incident triage and response, executing threat hunts grounded in threat intelligence, and refining detections and automation alongside agentic workflows to reduce manual effort.
WHAT YOU'LL DO
Detection Engineering: Design, implement, and maintain detections in Splunk and related security platforms; write detection-as-code (YAML/JSON) with unit tests and MITRE ATT&CK mapping.
Incident Response & Triage: Lead alert triage, scoping, containment, eradication, and post-incident reviews; document decisions to refine response workflows.
Threat Hunting: Execute hypothesis-driven hunts using attacker frameworks (Diamond Model, MITRE ATT&CK, Cyber Kill Chain) across multi-source telemetry.
Threat Intelligence Integration: Operationalize CTI by mapping adversary tools, techniques, and indicators directly to detection and hunting pipelines.
Automation & Orchestration: Develop Python scripts, API integrations, and SOAR playbooks for automated enrichment, handoffs, and response actions with robust guardrails.
Cloud & Container Security Monitoring: Monitor AWS/GCP/Azure telemetry (CloudTrail, GuardDuty, cloud audit logs) and detect container/Kubernetes runtime anomalies.
Shift Discipline: Manage shift workflows, ensure seamless handover between global teams, and establish clear escalation criteria for high-severity incidents.
Content & Documentation: Create and maintain investigation playbooks, detection rules, and operational runbooks to ensure standard execution across shifts.
Agentic & AI-Assisted Workflows: Evaluate and implement AI-assisted investigation tools (such as LLM-based triage and autonomous agents) while maintaining human oversight and guardrails.
WHAT YOU BRING
10+ years in cybersecurity, incident response, detection engineering, or security operations
4+ years hands-on experience leading or executing threat hunts, incident investigations, or detection engineering in a SOC or SIEM environment
Deep hands-on experience with Splunk (search, dashboards, alerts, correlation searches, saved searches, deployment server, forwarder management)
Strong understanding of the incident response lifecycle: triage, scoping, containment, eradication, recovery, and post-incident learning
Solid grasp of networking, systems, cloud, and security architecture (identity, endpoint, network, cloud)
Ability to write Python scripts for data processing, API interaction, and automation
Proficiency with threat intelligence frameworks: MITRE ATT&CK, Diamond Model, kill chains, and TTPs
Experience with threat hunting methodologies: hypothesis-driven hunts, baselines, anomaly detection
Excellent written and verbal communication skills in English
Bachelor's/Master’s degree in Computer Science, Information Security, Engineering, or related technical field
Strongly Preferred:
Detection-as-code experience: Sigma, YARA-L, YAML/JSON detection formats, Git-backed repositories, unit testing, and frameworks such as Splunk Security Content.
Automation & SOAR: Hands-on experience with Tines, XSOAR, Splunk SOAR, or equivalent platforms for API-driven orchestration and response.
Cloud security operations: Familiarity with CloudTrail, GuardDuty, and audit logs across AWS, GCP, or Azure environments.
Container & Kubernetes security: Falco, eBPF-based detection, container runtime monitoring, supply chain security (image scanning,…