Intrusion Analyst III
Walmart Global Tech · Posted Oct 14
Software development, cloud infrastructure, and retail technology services for Walmart
Bengaluru, Karnataka, IndiaFull-timeOnsiteMid Level4–6 years₹22.0L–₹34.0L yearly<25 applicants
Information TechnologyRetail TechnologySoftware DevelopmentCloud ComputingArtificial IntelligencePublic Company
Be an early applicantFull time
Get a personal compatibility score
Add a resume for personal matches
About the role
The Information Security organization protects Walmart's customers, associates, information assets, and technology environment, and SOC Incident Management is the centralized security operations function responsible for monitoring, detecting, analyzing, investigating, escalating, and responding to security threats. As an Intrusion Analyst III, the role involves triaging and investigating cyber events across endpoint, network, email, identity, cloud, Windows, and Linux telemetry, feeding detection engineering improvements, and using AI/GenAI responsibly to strengthen analyst effectiveness, detection quality, and response outcomes alongside security engineers, incident responders, and threat intelligence teams.
What you will do
- Monitor, triage, analyze, investigate, and support remediation of cyber events using defined SOC procedures, playbooks, escalation paths, and service expectations.
- Perform investigation across endpoint, network, email, identity, cloud, Windows, and Linux telemetry; correlate evidence across multiple data sources to determine scope, impact, root cause, and recommended actions.
- Run approved commands, queries, scripts, and automation for assigned areas of work while maintaining appropriate operational controls and documentation.
- Identify indicators of compromise, suspicious behaviors, attack patterns, and emerging risks; escalate confirmed or high-risk incidents to the appropriate response teams.
- Communicate clearly with technical and business stakeholders during troubleshooting and security events, providing timely status, findings, risk context, and recommended next steps.
- Provide actionable input to improve alert logic, correlation rules, detection use cases, thresholds, enrichment, prioritization, and suppression of known false positives.
- Identify opportunities for new risk detection based on investigation trends, threat intelligence, recurring incidents, control gaps, and observed attacker behavior.
- Partner with engineering and platform teams to validate and operationalize detection improvements across SIEM, EDR, SOAR, email security, firewall, IPS, and cloud security tooling.
- Capture investigation learnings, recurring patterns, root causes, and operational gaps; recommend measurable improvements to SOC processes, playbooks, documentation, and analyst workflows.
- Use approved AI/GenAI capabilities (for example, Copilot, ChatGPT, Gemini, or enterprise-approved equivalents) to assist with investigation summarization, evidence correlation, query/script drafting, threat-context synthesis, case documentation, and recommendation generation.
- Critically validate AI-generated analysis against authoritative telemetry and security evidence before using it for incident decisions, escalation, remediation, or stakeholder communication. Maintain analyst accountability for final conclusions.
- Assess the quality of AI-assisted investigations by identifying inaccurate conclusions, missed evidence, weak reasoning, hallucinations, incomplete recommendations, or inconsistent outputs, and provide structured feedback for improvement.
- Help develop and refine prompts, analyst workflows, evaluation criteria, test cases, and feedback loops that improve the accuracy, consistency, explainability, and operational usefulness of AI-assisted SOC analysis.
- Identify appropriate opportunities to integrate AI/GenAI with SIEM, SOAR, EDR, threat intelligence, case-management, and knowledge-management workflows to reduce repetitive analyst effort and accelerate triage and investigation.
- Apply responsible-AI and security principles when using AI tools, including data handling, confidentiality, access controls, human oversight, traceability, and compliance with company policies and approved-use requirements.
- Monitor AI-assisted workflows for quality and operational risk, and escalate cases where AI output could create false assurance, inappropriate remediation, data exposure, or other security impact.
- Contribute to AI readiness across the SOC by documenting effective practices, sharing lessons learned, and supporting analyst adoption and training for approved AI-enabled capabilities.
- Support cybersecurity intelligence and security-operations solutions by gathering requirements, researching technologies, participating in solution reviews, and contributing to supplier/product evaluations.
- Develop and review system, process, investigation, and operational documentation to support consistent execution and knowledge transfer.
- Maintain current knowledge of cybersecurity threats, attacker techniques, security technologies, automation, and AI/GenAI developments relevant to SOC operations.
- Participate in team assignments and projects, provide timely progress updates, contribute to team meetings and technical discussions, and support cross-functional initiatives.
- Create and review high-quality case notes, standard operating procedures, playbooks, knowledge articles, metrics, reports, and presentations for management, technical teams, customers, suppliers, and other stakeholders.
- Build collaborative relationships across functional and organizational boundaries and respond effectively to stakeholder and business-unit requests.
- Operate in accordance with company policies, security standards, procedures, ethical expectations, and applicable compliance requirements.
- Protect sensitive information throughout investigations and communications, using approved systems and appropriate data-handling practices.
- Demonstrate professional judgment, fact-based decision-making, transparency, and appropriate escalation when evidence is incomplete or risk is uncertain.
Skills used in this role
SIEMSOAREDRMicrosoft SentinelAzure SentinelGoogle ChronicleEmail SecurityFirewallIPSCloud SecurityMalware AnalysisPhishing AnalysisThreat IntelligenceIncident ResponseDetection EngineeringCase ManagementAutomationWindowsLinuxAIGenAICopilotChatGPTGeminiCommunication
What the employer is looking for
- B.E./B.Tech/M.S./M.Tech/MCA or equivalent technical qualification, with approximately 4–6 years of relevant SOC/cybersecurity operations experience.
- Hands-on experience with EDR and SIEM technologies across on-premises and cloud environments; Azure Sentinel/Microsoft Sentinel and Google Chronicle experience is desirable.
- Experience with SOAR, email security, incident/case management, firewall, IPS, security correlation, detection use-case development, and deployment.
- Hands-on cybersecurity investigation skills including malware analysis, phishing/email analysis, network and endpoint investigation, and Windows/Linux operating-system analysis.
- Practical exposure to AI/GenAI tools such as Copilot, ChatGPT, and Gemini, with the ability to use them responsibly and critically in cybersecurity workflows.
- Ability to develop or adapt security queries, scripts, and automation to support investigation and operational efficiency.
- Experience working with global teams and flexibility to work rotational shifts as business needs require.
- Professional Judgment: Researches and integrates relevant information and evidence, applies fact-based criteria, looks beyond symptoms, identifies root causes, and makes defensible recommendations.
- Execution & Results: Prioritizes effectively, uses established tools and processes, manages time and operational challenges, and delivers against business and security objectives.
- Planning & Continuous Improvement: Develops practical improvement plans, anticipates potential problems, and identifies opportunities to streamline processes and improve SOC performance.
- Influence & Communication: Communicates technical findings and risk clearly, proactively shares timely updates, listens actively, and prepares effective documentation and presentations.
- Relationship Building: Builds trusting, collaborative relationships across teams, organizational levels, and diverse backgrounds.
- Customer/Member Focus: Understands stakeholder needs and uses data, analysis, and insights to improve service and security outcomes.
- Ethics & Compliance: Models ethical conduct, follows policies and procedures, protects sensitive information, and supports compliance expectations.
- Adaptability & Learning: Adapts to changing priorities, embraces new responsibilities and technologies, and continuously updates and shares knowledge.
- Analytical Problem Solving: Demonstrates strong investigation, reasoning, decision-making, and problem-solving skills in complex and fast-moving situations.
Preferred qualifications
- Industry certifications such as CIH, CompTIA Security+/CySA+ or related CompTIA certifications, CEH, or other relevant cybersecurity certifications.
- Experience improving SOC processes through automation, detection engineering, analytics, or AI-assisted investigation workflows.
- Demonstrated interest in emerging technology and a track record of taking ownership in a fast-paced, results-driven environment.
Benefits and support
- Compensation and benefits are detailed in the job posting
About Walmart Global Tech
Walmart Global Tech is the technological powerhouse and engineering arm of Walmart Inc., responsible for building and managing foundational technologies, cloud infrastructure, and software systems. The organization powers global retail operations across Walmart U.S., Sam's Club, and Walmart International, delivering customer experiences and enterprise services worldwide. Operating across multiple global hubs, it unites engineering, data science, product design, and artificial intelligence to digitally transform retail.
- Industry
- Information Technology
- Company size
- 25000+ employees
- Founded
- 2011
- Location
- Bentonville, Arkansas, USA
- Funding stage
- Public Company
Leadership
SK
Suresh Kumar
Executive Vice President, Global Chief Technology Officer and Chief Development Officer
DD
Daniel Danker
Executive Vice President, AI Acceleration, Product and Design
SR
Sanjay Radhakrishnan
Senior Vice President and Tech Operating Partner, Walmart International