Supporting customer experiences worldwide, this Information Security Specialist role is crucial for maintaining a strong security posture. The position involves continuous monitoring of security operations, executing vulnerability and penetration testing, and meticulous management of security evidence. This role is ideal for a hands-on individual with a strong investigative mindset who can balance alert response with VAPT execution within the same role.
Responsibilities
Monitor SOC queues and investigate alerts from Managed SOC/SIEM, endpoint, identity, email-security, DLP, VPN/proxy and endpoint-compliance sources
Enrich SOC alerts using user, device, IP, ASN, geo-location, application, timestamp, IOC, endpoint posture, related tickets and historical evidence
Document investigations with working notes, screenshots, containment status, closure rationale, ticket updates and shift handover notes
Execute scheduled and ad hoc vulnerability scans for infrastructure and applications; validate findings before escalation
Perform web application and API security testing under defined scope; mobile application testing is excluded unless separately assigned in the future
Review SAST/DAST findings, assist with secure-code review and coordinate with application/development owners for remediation evidence
Track vulnerability remediation and retesting in ServiceNow or approved workflow tools; maintain clean closure, retest and exception evidence
Support containment actions including account disablement, device freeze/quarantine/isolation, suspicious-session review, user outreach and restoration evidence
Prepare SOC monitoring inputs and VAPT status inputs including open vulnerabilities, overdue remediation, retest outcomes, repeat findings and escalation items
Provide security evidence from SOC/VAPT work when requested for audit/client/security review; do not own GRC program activities
Ensure SOC alerts are triaged consistently with evidence, classification, escalation notes and closure rationale (success measure)
Validate, document and track infrastructure, web/API and SAST/DAST findings through remediation or retest (success measure)
Escalate high-risk identity, endpoint, email, DLP, vulnerability and VPN/proxy events without delay (success measure)
Maintain ServiceNow/security tickets that are complete, evidence-backed and aligned to SOC/VAPT operating expectations (success measure)
Requirements
Hands-on investigative mindset with the discipline to perform practical triage and testing, not only ticket monitoring or scanner-output forwarding
Strong escalation discipline — knows when and how to escalate to Consultant/InfoSec lead, IT Ops, GSD, Endpoint, Development, HR/Ops, TAM or Legal based on severity and impact
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
Meticulous evidence and retesting hygiene, consistently capturing screenshots, timestamps, tool outputs, reproduction steps and closure comments
Clear, business-formal written communication for incident notes, vulnerability findings, remediation follow-ups and shift handovers
Comfortable operating across a hybrid scope — balancing SOC alert response with VAPT execution within the same role
Collaborative approach when coordinating with application/development owners, IT Ops and cross-functional teams on remediation evidence
Ownership and accountability for closure quality, without extending into GRC program ownership
Adaptable and detail-oriented, able to brief a Consultant/InfoSec lead with concise facts and risk indicators
Minimum 3-5 years of experience and working knowledge across the following areas:
SOC Operations: 3-5 years in SOC, MDR, InfoSec operations, endpoint security, vulnerability management or security monitoring support; BPO, healthcare, PCI or client-regulated environment exposure preferred
Vulnerability Assessment: Ability to run scans, validate vulnerabilities, capture evidence, prepare remediation notes and support retesting; Nessus/Qualys/OpenVAS and ServiceNow remediation tracking experience preferred
Web/API Testing: Working knowledge of OWASP Top 10, web/API testing methodology and manual validation using Burp Suite or OWASP ZAP; experience preparing concise technical finding write-ups preferred
SAST/DAST/Code Review: Ability to review tool findings, understand vulnerable code patterns and coordinate with developers under senior guidance; familiarity with SonarQube, Snyk, Semgrep, Checkmarx, Veracode or Fortify preferred
Communication and Evidence: Clear business-formal writing for incident notes, vulnerability findings, remediation follow-ups and shift handovers; able to brief a Consultant/InfoSec lead with concise facts and risk indicators
SIEM/MDR Tooling: Arctic Wolf/Aurora, Microsoft Sentinel or equivalent SIEM, Splunk/QRadar fundamentals, ServiceNow ticketing and IOC enrichment workflows
Identity/Endpoint Tooling: Microsoft Entra ID, Conditional Access, MFA, Defender for Endpoint, FortiEDR, Absolute, Intune/JamF, BitLocker/FileVault and endpoint evidence capture
Email/DLP Tooling: Abnormal AI / O365 email security, Microsoft Purview DLP, phishing/BEC/ATO investigation queues and remediation evidence
AD/Windows Exposure Awareness: BloodHound, PingCastle and NetExec/CrackMapExec awareness for privilege path, misconfiguration and exposure validation under supervision
Web/API Testing Tools: Burp Suite, OWASP ZAP, Postman, API collections and manual validation for authentication, authorization, session and input-handling issues
SAST Tools: Checkmarx, Veracode, SonarQube, Fortify, Snyk, Semgrep or equivalent; ability to read code paths and identify likely vulnerable patterns
DAST Tools: Burp Suite, OWASP ZAP, Acunetix, Invicti/Netsparker, AppScan or equivalent; validate output before raising remediation tickets
Cloud Security Basics: Microsoft Defender for Cloud / Azure posture review basics, AWS exposure awareness, Prowler/ScoutSuite-style output interpretation where applicable
Connectivity Context: FortiSASE, FortiGate, VPN, IPQS/IP2Proxy or equivalent tools for VPN/proxy/geolocation validation
Nice to have:
Desirable Certifications: eJPT / PNPT / CEH Practical, CompTIA PenTest+ / Security+ / CySA+, Burp Suite certification or web testing training, Splunk Core / SIEM fundamentals
About the Company
Everise is a global experience company dedicated to elevating customer experiences for people around the world. With 13 centers globally and a robust work-at-home program, the company focuses on being people-first, celebrating diversity, and incubating innovation.
