Senior Security Operations Engineer

About the role

We are looking for a Senior Security Operations Engineer to join Couchbase’s global Information Security team in Bangalore. You will split your time between hands‑on incident triage and building automated detection and response capabilities, leveraging AI to improve security operations.

Key responsibilities

• Own alert triage, investigation and containment, managing the SIEM, log source onboarding and correlation rule development.
• Develop and tune AI‑assisted workflows for enrichment, automated containment and threat ranking.
• Run the vulnerability management lifecycle across endpoints, servers, network devices and cloud workloads, prioritising based on exploitability and business impact.
• Operate CSPM/CNAPP tooling across AWS, Azure, GCP and Kubernetes, enforce policies and manage exceptions.
• Support identity security functions such as privileged access management, MFA, conditional access and detection of credential abuse.
• Configure DLP for AI channels, monitor shadow‑AI usage and support AI risk‑tiering and red‑team exercises.
• Produce security metrics, program reporting and audit evidence for SOC 2, ISO 27001 and related frameworks.

Required profile

• 5–8 years of hands‑on security operations experience with real incident triage and containment.
• Deep practical experience with SIEM platforms (e.g., Splunk, Sentinel, Elastic) and writing detection rules.
• Strong public‑cloud security skills on at least one of AWS, Azure or GCP, plus Kubernetes knowledge.
• Hands‑on experience with EDR solutions (e.g., SentinelOne, CrowdStrike) and vulnerability‑management tools.
• Proficiency in Python scripting, REST APIs and infrastructure‑as‑code tools such as Terraform.
• Familiarity with identity platforms (Okta or equivalent) and NIST CSF assessments.
• Curiosity about applying AI to security work and sound judgment on automation trust.

Required skills

• SIEM (Splunk, Sentinel, Elastic, Coralogix)
• AWS, Azure, GCP
• Kubernetes
• EDR (SentinelOne, CrowdStrike)
• Vulnerability management tools (Rapid7, Qualys, Tenable)
• Python
• REST APIs
• Terraform
• Identity platforms (Okta)
• NIST CSF