Gms-staff-threat Analyst jobs at Ey in India, Thiruvananthapuram

The Senior Security Analyst in Cyber Defense CTF (Cyber Triage and Forensics) plays a

• You will work collaboratively to detect and respond to information security incidents, develop, maintain, and follow procedures for security event alerting, and participate in security investigations.
• Engage in proactive threat hunting and provide expert security assessments, utilizing EDR, SIEM, and other tools to understand and counteract the cybercrime landscape
• Communicate with IT stakeholders during incident response activities, ensuring effective containment, remediation, and accurate identification of compromise indicators
• Report on incident metrics, analyse findings, and develop reports to ensure comprehensive resolution and understanding of security events
• Act as an escalation point for incident response, shiftlead, mentor junior team members, and contribute to team skill enhancement
• Analyse security events, provide feedback on security controls, and drive process improvements to strengthen the organization's security posture
• Maintain and improve security incident processes, protocols, and standard operating procedures to reflect best practices in security incident response

• Proficient in Cyber investigationincluding evidence management in line with best practices and using advanced tools for threat detection and incident management including advanced querying with KQL

• Proficient in analyzing varied data sets, identifying malware, and conducting comprehensive security event analysis from network traffic attributes and host-based attributes to detect information security incidents and latent threats.

• Proficient in conducting detailed forensic investigations across various operating systems, with a keen eye for obfuscation and the ability to clearly communicate findings
• In-depth understanding of Active Directory security, with strong scripting abilities to automate response measures and improve operational effectiveness

• Undergraduate or Postgraduate Degree in Computer Science, Engineering, or a related field (MCA/MTech/BTech/BCA/BSc CS or BSc IT)
• At least 7 years of overall experience with a minimum of 5 years specialized in incident response, computer forensics, and Security Operations.
• Proficiency in operating within a Security Monitoring/Security Operations Center (SOC) environment, including experience with CSIRT and CERT operations
• Demonstrated experience in investigating security events, threats, and vulnerabilities
• Strong understanding of electronic investigation and forensic methodologies, including log correlation, electronic data handling, investigative processes, and malware analysis
• In-depth knowledge of Windows and Unix/Linux operating systems, and experience with EDR solutions for threat detection and response

• Desired certifications such as SSCP, CEH, GCIH, GCFA, GCIA, GSEC, GIAC, Security+.
• Experience with security incident response in cloud environments, including Azure.
• Knowledge of legal considerations in electronic discovery and analysis
• Proficiency in scripting or programming (e.g., Shell scripting, PowerShell, C, C#, Python)
• Solid understanding of security best practices for network architecture and server configuration

• Demonstrates integrity in a professional environment
• Strong ethical behavior
• Ability to work independently
• Possesses a global mindset for working with diverse cultures and backgrounds
• Knowledgeable in industry-standard security incident response processes, procedures, and lifecycle
• Positive attitude and Excellent teaming skills
• Excellent social, communication, and writing skills
• Good presentation skills
• Excellent investigative, analytical, and problem-solving skills

• Coordinate escalations and collaborate with internal technology teams to ensure timely resolution of issues
• Provide mentoring and training to other team members as required, supporting their development and ensuring consistent team performance

• Should be willing to work in shifts

What we offer

• Continuous learning:You will develop the mindset and skills to navigate whatever comes next.
• Success as defined by you:We will provide the tools and flexibility, so you can make a significant impact, your way.
• Transformative leadership:We will give you the insights, coaching and confidence to be the leader the world needs.
• Diverse and inclusive culture:You will be accepted for who you are and empowered to use your voice to help others find theirs.

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

KEY Capabilities:

• Experience in working with SIEM Solutions such as Splunk or Azure Sentinel.
• Experience in working with any of Endpoint Detection and Response tools preferably Crowdstrike, Sentinel One or Microsoft Defender for Endpoint.
• Expertise in SIEM and EDR content development with an eye towards behavior-based detection logic.
• Strong background in host based and network-based behaviors.
• Familiarity of Windows Event ID’s and common application logs.
• Knowledge in programming or scripting languages such as Batch Scripting, Python PowerShell, etc.
• Experience in purple teaming activities.
• Hands-on experience on threat Hunting for identification of interested events for content development.
• Analyze and investigate broad range of threats or cyber activities occurring on daily basis.
• Provide actionable insights to help identify, detect, prevent, and respond to potentially malicious activities.

Qualification & experience:

• Minimum of 3 to 7 years’ experience with in-depth host, network architecture knowledge that will translate over to effective content development.
• Minimum of 3 years SOC experience.
• An adversarial mindset, understanding the goals, behaviors, and TTPs of threat actors.
• Strong oral, written and listening skills are an essential component to effective consulting.
• Ability to work at all layers of the OSI models, including being able to explain communication at any level is necessary.
• Must have content development knowledge in Endpoint Detection and Response (Defender/CrowdStrike), SIEM (Splunk/Sentinel).
• Must have knowledge of Windows and Linux basics including command and script interpreters, PowerShell, registries etc.
• Troubleshoot EDR and SIEM platform and application issues, escalate and work with relevant teams to resolve issues.
• Certifications in a core security related discipline will be an added advantage.
• Certification in any one of the SIEM, EDR or Network Solutions such as Splunk, Azure Sentinel, Falcon Crowdstrike, SentinelOne will be an added advantage.

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Global Managed Service – Identity and access Management – Senior

The IAM Administrator role will be primarily responsible for the support and enhancements that are required for the engagement. Also adhering to stated SLA’s and ensuring high standards of quality deliverables.

Key Requirements / Responsibilities:

• Experience in working on any two IAM engagements providing application support (SailPoint IIQ or SailPoint IDN).
• Provide Level 2 and Level 3 support for the system within agreed service levels
• Implement and manage the effectiveness of Incident, Service Request, Change and Problem management processes for the service area
• 3 to 4 years of experience in support, customization, configuration and deployment of any Identity Management and Governance products
• Support IGA tool integration with critical applications and infrastructure
• Assist stakeholder teams as required, coordinate with product engineering team
• Resolve technical issues through debugging, research, and investigation.
• Understands of below IGA concepts:
  • User Lifecycle Management, Provisioning, and Reconciliation
  • Auditing, Reporting, and user activity Monitoring
  • Access Certification
  • SOD
• Java/J2EE and knowledge on SQL
• Strong communication skills, both verbal and written
• Must be able to thrive in a fast-paced, high-energy environment
• Ability to work independently, adapt quickly, and maintain a positive attitude
• Troubleshoot and maintain user onboarding workflows and role provisioning
• Ability to perform Root Cause Analysis and suggest solutions to avoid errors
• Support onboarding of application and platform users.
• Monitor IAM platform components and resource
• Provide IAM support to end users.
• Work involves day to day health check, incident support (as per defined scope and levels), e-mail support, tool upgrades and monitoring of systems, reporting the status and working with Development and QA teams to help them fix the issues.
• Should be a good team player to work on a competitive environment
• Must have experience in Application Onboarding
• Experience with IGA integrations, connectors, custom integrations, application patterns, strong technical acumen
• Perform systems analysis and tuning to insure optimal infrastructure response

Qualifications:

Education:

• Bachelor's Degree required

Skills Expertise

• Good soft skills i.e., verbal & written communication and technical document writing
• Prior experience working in remote teams on global scale
• Customer orientation skills
• Scripting knowledge

Work Requirements:

• Willingness to travel as required
• Willingness to be on call support engineer and work occasional overtime as required
• Willingness to work in shifts as required

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Your key responsibilities

• Architecting and implementation of Defender XDR.
• Perform as the subject matter expert on Microsoft Defender for the customer, use the capabilities of the solution in the daily operational work for the end customer.
• Securing overall cloud environments by applying cybersecurity tools and best practices
• Advise customers on best practices and use cases on how to use this solution to achieve customer end state requirements.
• Content development which includes developing process for automated security event monitoring and alerting along with corresponding event response plans for systems

Skills and attributes for success

• Hands-on experience with Microsoft Defender and related technologies (e.g., Windows Defender, Microsoft Defender XDR, Defender for cloud, Defender for IoT).
• Ability to work independently and collaboratively in a fast-paced environment, with a strong commitment to customer service and teamwork.
• Expertise in use case management in Defender XDR
• Create and maintain documentation related to Microsoft Defender configuration, policies, procedures, and incident response playbooks.
• Expertise in Microsoft Intune for AV policy creation and deployment
• Knowledge in Cloud technologies such as Azure, AWS
• Strong technical knowledge in Windows Server/Linux
• Identify opportunities for performance optimization and efficiency improvements within Microsoft Defender solutions, and implement changes as needed
• Scripting knowledge (Python, Bash, PowerShell)
• Extensive knowledge of different security threats
• Good knowledge and experience in Security Monitoring
• Good knowledge and experience in Cyber Incident Response

To qualify for the role, you must have

• B. Tech./ B.E. with sound technical skills
• Strong command on verbal and written English language.
• Demonstrate both technical acumen and critical thinking abilities.
• Strong interpersonal and presentation skills.
• Certification in Azure (SC-200, SC-100, SC-900,AZ-500) (any other cloud vendor certification is a plus)

You get to work with inspiring and meaningful projects. Our focus is education and coaching alongside practical experience to ensure your personal development. We value our employees and you will be able to control your own development with an individual progression plan. You will quickly grow into a responsible role with challenging and stimulating assignments. Moreover, you will be part of an interdisciplinary environment that emphasizes high quality and knowledge exchange. Plus, we offer:

• Support, coaching and feedback from some of the most engaging colleagues around
• Opportunities to develop new skills and progress your career
• The freedom and flexibility to handle your role in a way that’s right for you

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

: Consultant-National-Forensics-ASU - Forensics - Investigations & Compliance - Mumbai

Technical Excellence

• Fraud Investigation and Internal Audit

Qualification

• Bachelor of Commerce
• Master of Business Administration

Experience

• Data Analysis (2+ years)

People with the ability to work in a collaborative manner to provide services across multiple client departments while following the commercial and legal requirements. You will need a practical approach to solving issues and complex problems with the ability to deliver insightful and practical solutions. We look for people who are agile, curious, mindful, and able to sustain positive energy, while being adaptable and creative in their approach.If you can confidently demonstrate that you meet the criteria above, please contact us as soon as possible.

We are looking for ato design and optimize scalable, secure, and cost-efficient cloud infrastructure. You will lead DevOps initiatives, mentor the team, and drive adoption of modern CI/CD, automation, and security practices to enable fast, reliable software delivery.

Your key responsibilities

• Design and build DevOps solutions on GCP that fit business and engineering needs. Set up cloud strategies that make development, testing, and deployment efficient.
• Give technical guidance and coach team members so they grow strong GCP and DevOps skills.
• Help define long-term infrastructure plans and promote the use of GCP across the organization.
• Choose the right GCP tools and third-party products to improve CI/CD, monitoring, and automation.
• Create and manage GCP services (e.g., Compute Engine, GKE, Cloud Functions, Pub/Sub, Cloud Storage, BigQuery, Cloud SQL/Spanner) using Infrastructure as Code (Terraform/Deployment Manager).
• Build and improve secure delivery pipelines with Cloud Build, Artifact Registry, and Spinnaker/ArgoCD. Make sure rollback, backup, and disaster recovery use GCP services.
• Improve performance and scale by tuning Kubernetes (GKE), networking, and autoscaling. Use Cloud Operations Suite (Stackdriver) for monitoring.
• Apply security best practices in daily work: set IAM policies, use VPC Service Controls, run vulnerability scans with Security Command Center, and manage secrets safely.
• Reduce costs by right sizing resources, using committed use discounts, and tracking spending with Billing & Cost Management tools.
• Keep infrastructure compliant and governed according to industry standards and regulations.
• Promote continuous improvement by suggesting better practices, new GCP features, and automation ideas.

Skills and attributes for success

• Completed higher education in Computer Science or a related field (or equivalent practical experience).
• 5+ years of hands-on experience in DevOps practices and cloud computing, with a primary focus on Google Cloud Platform.
• Deep knowledge of GCP services across compute, storage, networking, and security domains (e.g., Compute Engine, GKE, VPC, Cloud Armor, Cloud Identity).
• Proven track record of implementing and managing CI/CD pipelines on GCP (Cloud Build, GitHub Actions) and automating workflows with IaC (Terraform, Deployment Manager).
• Proven track record of applying GitOps principles to manage infrastructure and application deployments in cloud environments.
• Proficiency in scripting and automation with Python and Shell scripting for infrastructure and operational tooling.
• Proficiency in containerization (Docker) and orchestration (Kubernetes/GKE), including service mesh (Istio/Anthos) and workload identity integration.
• Strong understanding of cloud security practices, including IAM role design, key management (KMS), encryption, vulnerability management, and compliance frameworks.
• Experience with monitoring and observability using Cloud Operations Suite (Logging, Monitoring, Trace, Profiler) and integrations with tools like Prometheus and Grafana.
• Proficiency in Git and branching strategies in collaborative engineering environments.
• Excellent leadership, communication, and mentoring skills, with proven experience guiding teams in adopting new cloud practices.
• Full professional proficiency in English (written and spoken) and demonstrated integrity in a professional environment.

Nice to have

• GCP Professional certifications (Cloud Architect, DevOps Engineer, or Data Engineer).
• Any additional vendor cybersecurity or cloud-related certifications (e.g., Terraform, Kubernetes).

What we offer you

• Get free certifications and enjoy national & international training.

• Get extra vacation days when public holidays fall on a weekend.

• Join an EY Community and practice your hobby with your colleagues off-work.

• Get plenty of discounts, perks and medical coverage.

• Free access to Udemy, EY Badges

• Bookster library

• Medical subscription for employees and family members (wife/husband/children)

• Life & accident insurance

• EAP – Employee Assistance Program - Short term confidential counselling services for you and those who live with you.

Code: C

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Global Managed Service – Identity and access Management – Senior

The IAM Administrator role will be primarily responsible for the support and enhancements that are required for the engagement. Also adhering to stated SLA’s and ensuring high standards of quality deliverables.

Key Requirements / Responsibilities:

• 4+ years of experience in support, customization, configuration and deployment of any Identity Management and Governance products
• Experience in working on any two IAM engagements providing application support.
• Provide Level 2 and Level 3 support for the system within agreed service levels.
• Should have experience on One Identity requirement gathering, design and implementation.
• Will be responsible for applications onboarding.
• Experience in implementing at least two IAM engagements including requirements gathering, analysis, design development, testing deployment and application support (One Identity/other IAM)
• Experience in technologies, such as VB.net, LDAP, AD and SQL.
• Good knowledge of Web/application servers (IIS, WebSphere WebLogic, JBoss and Apache)
• Experience in development configuration of standard custom IAM integrations using VB.net.
• Experience in hands on development, estimations, sizing and custom IAM integrations.
• Advanced documentation and presentation skills and well-versed with SDLC process.
• Ability to create plan and execute advanced IAM trainings and independently drive proof of concepts involving emerging IAM technologies.
• Exposure to process frameworks and methodologies.
• Should have experience in interacting with Clients, including working with client teams in an onsite and offshore delivery model.
• Contribute to eminence activities, such as automating manual tasks performed by One Identity Administration team.
• Customize, configure, and develop One Identity solution integrations using requirements and design and independently manage project deliverables to successful completion.
• Lead process compliance activities by identifying and driving initiatives that are relevant for the project delivery and help factor reusability and related benefits.
• Vendor coordination
• Application patch deployment.
• Troubleshoot One Identity Issues
• Understands of below IGA concepts:
  • User Lifecycle Management, Provisioning, and Reconciliation
  • Auditing, Reporting, and user activity Monitoring
  • Access Certification
  • SOD
• Strong communication skills, both verbal and written

Qualifications:

Education:

• Bachelor's Degree required.

Skills Expertise

• OneIdentity Manager 6.0, 7.0 or later
• Scripting knowledge like VB.net, PowerShell etc.
• Good soft skills i.e. verbal & written communication, technical document writing etc.
• Exposure to global security standards e.g. PCI, SOX, HIPAA etc.
• Prior experience working in remote teams on global scale.

Work Requirements:

• Willingness to work in shifts as required

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.