Security Operations

• Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security tools, and cloud platforms
• Analyze host and network logs from Windows, Linux, databases, applications, web servers, firewalls, and NIDS/HIDS
• Investigate suspicious activity and identify potential root causes
• Support incident response, remediation, and recovery activities
• Determine appropriate escalation paths and coordinate with relevant cybersecurity teams
• Work with Incident Response specialists to investigate and manage threats
• Identify opportunities to improve detection quality and reduce false positives
• Support security monitoring optimization and whitelist tuning
• Prepare technical reports, summaries, and security findings
• Maintain SOC documentation, procedures, and knowledge-base content
• Contribute to process improvements and operational quality initiatives

Security Operations Analyst – Cyber Defense

• Implement and verify technical controls across the cardholder data environment, including access management, secure configuration, logging and monitoring, vulnerability management, encryption and key management, and secure development practices.
• Deliver PCI DSS v4.0.1 logging and monitoring requirements, including centralised audit-log collection, log protection, retention, automated review, time synchronisation, critical-file change detection, and failure alerting.
• Work with the DevOps engineer on Wazuh rollout, owning compliance outcomes such as log-source coverage, detection and correlation rules, file-integrity monitoring, retention, validation, and evidence.
• Define the alert triage and response routine for daily client-team operations.
• Complete SAQ D for Service Providers and assemble supporting evidence.
• Maintain network and cardholder dataflow diagrams, scoping and segmentation documentation, policies, and operating procedures.
• Engage and manage an Approved Scanning Vendor for quarterly external vulnerability scanning and drive remediation.
• Scope and coordinate penetration testing with a qualified independent provider; manage remediation and retesting.
• Maintain third-party service-provider due diligence, including partner AOC collection and shared-responsibility documentation.
• Own the delivery plan, schedule, dependencies, risk log, and weekly leadership reporting.
• Strengthen change management so changes are raised, approved, tested, and evidenced consistently.
• Document repeatable operational routines for the client team after the engagement ends.

Security Operations jobs in Sri Lanka

Security Operations Analyst – Cyber Defense

Security Operations Engineer – PCI DSS