SOC Analyst at PwC India in Bengaluru

Role Summary:
Support SOC security monitoring through effective security data onboarding, governance, normalization, and quality management. Ensure security telemetry is onboarded consistently, aligned with Splunk CIM standards, and supports detection, compliance, and operational requirements.

Key Responsibilities

• Manage security data onboarding, governance, and normalization activities.
• Review onboarding requests and ensure monitoring, compliance, and operational requirements are met.
• Validate field mappings, tagging, data models, and data quality.
• Drive adoption of Splunk Common Information Model (CIM).
• Perform onboarding QA, completeness checks, and use-case readiness assessments.
• Collaborate with Security Content SMEs, SOC teams, and Splunk Platform teams.
• Support data routing, filtering, transformation, enrichment, and ingestion optimization.
• Identify telemetry gaps and improve monitoring coverage.
• Maintain onboarding documentation, governance records, reporting, and audit evidence.

Mandatory Skills

• Splunk SIEM & Splunk CIM
• Security Data Onboarding & Governance
• Data Normalization, Field Mapping & Data Quality
• Log Management & Security Monitoring (SOC)
• Security Telemetry Management
• Security Log Sources (Cloud, Network, Endpoint, Application, Database)
• Stakeholder Management & Documentation
• Analytical & Troubleshooting Skills

Preferred Skills

• Cribl
• Splunk Enterprise
• Detection Engineering
• MITRE ATT&CK
• Python / PowerShell
• Dashboarding & Reporting

Experience

• 3+ years in Security Data Management, Security Engineering, SIEM, SOC, Log Management, or Data Onboarding.
• Hands-on experience with log onboarding, normalization, field mapping, and governance.
• Experience working with security monitoring teams and platform engineering teams.
• Exposure to large-scale telemetry management and regulated environments preferred.

Qualifications

• Degree in Cyber Security, Information Security, Computer Science, IT, Data Engineering, or related field.
• Relevant SIEM/SOC experience.
• Splunk, Cribl, or Cyber Security certifications preferred.