Automation & Orchestration: Develop Python scripts, API integrations, and SOAR playbooks for automated enrichment, handoffs, and response actions with robust guardrails.
Cloud & Container Security Monitoring: Monitor AWS/GCP/Azure telemetry (CloudTrail, GuardDuty, cloud audit logs) and detect container/Kubernetes runtime anomalies.
Shift Discipline: Manage shift workflows, ensure seamless handover between global teams, and establish clear escalation criteria for high-severity incidents.
Content & Documentation: Create and maintain investigation playbooks, detection rules, and operational runbooks to ensure standard execution across shifts.
Agentic & AI-Assisted Workflows: Evaluate and implement AI-assisted investigation tools (such as LLM-based triage and autonomous agents) while maintaining human oversight and guardrails.
WHAT YOU BRING
10+ years in cybersecurity, incident response, detection engineering, or security operations
4+ years hands-on experience leading or executing threat hunts, incident investigations, or detection engineering in a SOC or SIEM environment
Deep hands-on experience with Splunk (search, dashboards, alerts, correlation searches, saved searches, deployment server, forwarder management)
Strong understanding of the incident response lifecycle: triage, scoping, containment, eradication, recovery, and post-incident learning
Solid grasp of networking, systems, cloud, and security architecture (identity, endpoint, network, cloud)
Ability to write Python scripts for data processing, API interaction, and automation
Proficiency with threat intelligence frameworks: MITRE ATT&CK, Diamond Model, kill chains, and TTPs
Experience with threat hunting methodologies: hypothesis-driven hunts, baselines, anomaly detection
Excellent written and verbal communication skills in English
Bachelor's/Master’s degree in Computer Science, Information Security, Engineering, or related technical field
Strongly Preferred
Detection-as-code experience: Sigma, YARA-L, YAML/JSON detection formats, Git-backed repositories, unit testing, and frameworks such as Splunk Security Content.
Automation & SOAR: Hands-on experience with Tines, XSOAR, Splunk SOAR, or equivalent platforms for API-driven orchestration and response.
Cloud security operations: Familiarity with CloudTrail, GuardDuty, and audit logs across AWS, GCP, or Azure environments.
Container & Kubernetes security: Falco, eBPF-based detection, container runtime monitoring, supply chain security (image scanning, vulnerability management)
Agentic & AI workflows: Experience evaluating or implementing LLM-assisted triage and AI-generated detections with strong human oversight.
Threat intelligence: Understanding of Priority Intelligence Requirements (PIRs) and operationalizing CTI into detection pipelines.
Scripting & IaC: Proficiency in Python, Bash, or Go; exposure to Infrastructure-as-Code tools (Terraform, CloudFormation).
Global operating models: Experience with follow-the-sun operational models and optimizing MTTD/MTTA/MTTC metrics.
Certifications: Relevant industry certifications such as GCIH, GCIA, AWS Certified Security - Specialty, or CKS.
Attack Surface Management: Experience in secret hygiene management, identity attack surface monitoring, and managing Shadow AI risk.
Office Location: We are primarily an in-office environment and therefore, you will be expected to work from the Bangalore office in compliance with Everpure’s policies, unless you are on PTO, or work travel, or other approved leave.
WHAT YOU CAN EXPECT FROM US
Innovation: We celebrate those who think critically, like a challenge, and aspire to be trailblazers.
Growth: We give you the space and support to grow along with us and to contribute to something meaningful. We have been named Fortune's Best Workplaces in Technology™, Fortune's Best Workplaces in the Bay Area™, and certified as a Great Place to Work®!
Team: We build each other up and set aside ego for the greater good.
And because we understand the value of bringing your full and best self to work, we offer a variety of perks to manage a healthy balance, including flexible time off, wellness resources, and company-sponsored team events. Check out http://benefits.everpuredata.com/ for more information.
ACCOMMODATIONS AND ACCESSIBILITY
Candidates with disabilities may request accommodations for all aspects of our hiring process. For more on this, contact us at TA-Ops@purestorage.com if you’re invited to an interview.
OUR COMMITMENT TO A STRONG AND INCLUSIVE TEAM
We’re forging a future where everyone finds their rightful place and where every voice matters. Where uniqueness isn’t just accepted but embraced. That’s why we are committed to fostering the growth and development of every person, cultivating a sense of community through our Employee Resource Groups and advocating for inclusive leadership.
Everpure is proud to be an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender, gender identity, gender expression, transgender status, sexual stereotypes, age, status as a protected veteran, status as an individual with a disability, or any other characteristic legally protected by the laws of the jurisdiction in which you are being considered for hire.
Join us and bring your best.
Bring your bold.
Pure and simple.
