Back
Everpure logo

Staff Security Operations Engineer

Everpure · Posted Nov 5

Enterprise data storage and management platform for apps, analytics, and AI

Bangalore, IndiaFull-timeOnsiteLead/Staff10+ years₹60.0L–₹1.0Cr yearly<25 applicants
Data StorageEnterprise Data CloudAI InfrastructureFlash StoragePublic Company
Be an early applicantFull time

Get a personal compatibility score

Add a resume for personal matches

About the role

Everpure is a data platform company serving hyperscalers, AI labs, the AI hardware supply chain, and data platform providers. The Bengaluru security operations team owns incident triage and response, threat hunting grounded in threat intelligence, and detection engineering. This role leads the security operations tempo for the Bengaluru shift, building detections and automation, including agentic and AI-assisted workflows, to reduce manual effort.

What you will do

  • Detection Engineering: Design, implement, and maintain detections in Splunk and related security platforms; write detection-as-code (YAML/JSON) with unit tests and MITRE ATT&CK mapping.
  • Incident Response & Triage: Lead alert triage, scoping, containment, eradication, and post-incident reviews; document decisions to refine response workflows.
  • Threat Hunting: Execute hypothesis-driven hunts using attacker frameworks (Diamond Model, MITRE ATT&CK, Cyber Kill Chain) across multi-source telemetry.
  • Threat Intelligence Integration: Operationalize CTI by mapping adversary tools, techniques, and indicators directly to detection and hunting pipelines.
  • Automation & Orchestration: Develop Python scripts, API integrations, and SOAR playbooks for automated enrichment, handoffs, and response actions with robust guardrails.
  • Cloud & Container Security Monitoring: Monitor AWS/GCP/Azure telemetry (CloudTrail, GuardDuty, cloud audit logs) and detect container/Kubernetes runtime anomalies.
  • Shift Discipline: Manage shift workflows, ensure seamless handover between global teams, and establish clear escalation criteria for high-severity incidents.
  • Content & Documentation: Create and maintain investigation playbooks, detection rules, and operational runbooks to ensure standard execution across shifts.
  • Agentic & AI-Assisted Workflows: Evaluate and implement AI-assisted investigation tools (such as LLM-based triage and autonomous agents) while maintaining human oversight and guardrails.

Skills used in this role

What the employer is looking for

  • 10+ years in cybersecurity, incident response, detection engineering, or security operations
  • 4+ years hands-on experience leading or executing threat hunts, incident investigations, or detection engineering in a SOC or SIEM environment
  • Deep hands-on experience with Splunk (search, dashboards, alerts, correlation searches, saved searches, deployment server, forwarder management)
  • Strong understanding of the incident response lifecycle: triage, scoping, containment, eradication, recovery, and post-incident learning
  • Solid grasp of networking, systems, cloud, and security architecture (identity, endpoint, network, cloud)
  • Ability to write Python scripts for data processing, API interaction, and automation
  • Proficiency with threat intelligence frameworks: MITRE ATT&CK, Diamond Model, kill chains, and TTPs
  • Experience with threat hunting methodologies: hypothesis-driven hunts, baselines, anomaly detection
  • Excellent written and verbal communication skills in English
  • Bachelor's/Master’s degree in Computer Science, Information Security, Engineering, or related technical field

Preferred qualifications

  • Detection-as-code experience: Sigma, YARA-L, YAML/JSON detection formats, Git-backed repositories, unit testing, and frameworks such as Splunk Security Content.
  • Automation & SOAR: Hands-on experience with Tines, XSOAR, Splunk SOAR, or equivalent platforms for API-driven orchestration and response.
  • Cloud security operations: Familiarity with CloudTrail, GuardDuty, and audit logs across AWS, GCP, or Azure environments.
  • Container & Kubernetes security: Falco, eBPF-based detection, container runtime monitoring, supply chain security (image scanning, vulnerability management)
  • Agentic & AI workflows: Experience evaluating or implementing LLM-assisted triage and AI-generated detections with strong human oversight.
  • Threat intelligence: Understanding of Priority Intelligence Requirements (PIRs) and operationalizing CTI into detection pipelines.
  • Scripting & IaC: Proficiency in Python, Bash, or Go; exposure to Infrastructure-as-Code tools (Terraform, CloudFormation).
  • Global operating models: Experience with follow-the-sun operational models and optimizing MTTD/MTTA/MTTC metrics.
  • Certifications: Relevant industry certifications such as GCIH, GCIA, AWS Certified Security - Specialty, or CKS.
  • Attack Surface Management: Experience in secret hygiene management, identity attack surface monitoring, and managing Shadow AI risk.

Benefits and support

  • Flexible time off
  • Wellness resources
  • Company-sponsored team events

About Everpure

Everpure logo

Everpure

Company website
LinkedInXCrunchbaseGlassdoor★4.2

Everpure is an enterprise data storage and management company that unifies all data with an enterprise data cloud, making it easy to manage and get AI-ready fast. Formerly known as Pure Storage, the company delivers an industry-leading, ever-evolving storage and data management platform.

Industry
Data Storage
Company size
6000+ employees
Founded
2009
Location
Santa Clara, California, USA
Funding stage
Public Company

Funding

Public Company · $470M raised

Sutter Hill VenturesGreylock PartnersRedpoint Ventures
  • 2013-08-29Series E$150M
  • 2014-04-23Series F$225M

Leadership

CG
Charles Giancarlo

Chairman and CEO

RL

Rob Lee

Chief Technology Officer

DF

Dan FitzSimons

Chief Revenue Officer

Recent coverage

Apply