Location: Hyderabad (Office)
Job Description Summary
We are seeking a hands-on Cloud Detection Engineer to help shape the future of cloud security monitoring at Novartis. You will design, build, validate and continuously improve detection capabilities across Azure, AWS and other strategic cloud platforms while being a key partner with incident response and cloud security architect teams. An engineering role that combines cloud telemetry, custom detections, threat research, automation and AI-assisted investigation to create high-signal, scalable outcomes for Cyber Defense.
Role purpose
Build a robust, AI-native cloud detection pipeline that improves correlation and investigation efficiency across multi-cloud environments. Engineer fragmented cloud telemetry into clear, actionable security outcomes with AI embedded throughout the detection engineering lifecycle. A multidimensional engineering role at the intersection of automation, cloud architecture, threat behavior analysis, detection engineering supporting analyst investigation workflows.
Key Responsibilities
Design and operate an AI-native cloud detection pipeline that aggregates, correlates, enriches, deduplicates and prioritizes signals before analyst investigation
Build and tune high-fidelity detections that improve coverage across cloud control-plane, data plane and management-plane activity, identity and access, network, container and Kubernetes and security posture.
Use lower-fidelity and behavioral signals as investigation context, while ensuring known high-confidence detections are consistently escalated for security investigation
Integrate and correlate telemetry from WIZ, Microsoft Defender for Cloud, AWS GuardDuty, Microsoft Sentinel and other cloud-native or CNAPP sources . Apply hands-on Wiz experience to interpret posture findings, attack paths, identity and exposure context, cloud events, runtime findings and threat detections and improve detection workflows
Develop behavioral baselines and entity-centric analytics across users, IP addresses, identities and cloud resources . Create reusable dashboards, dynamic lookups and enrichment patterns enabling rapid pivots / drilldowns from an alert to related resource, identity, inventory and historical data
Own the detection lifecycle from threat hypothesis and telemetry assessment through development, peer review, testing, deployment, tuning, documentation and retirement
Embed AI across the detection lifecycle to accelerate detection creation and tuning, while ensuring engineering controls and human judgment govern the outcomes
Finetune detections using historical data, controlled simulations, purple-team exercises, attack emulation and lessons learned from incidents and threat hunts
Use detection-as-code practices, Git, CI/CD and automated testing to deliver controlled, repeatable and auditable content changes . Partner with Threat Hunting and Response, CSOC analysts, cloud platform teams, data onboarding, threat intelligence and automation teams to close visibility gaps and operationalize detections
Automate enrichment and triage using Python, APIs, SOAR workflows and AI-assisted approaches, with appropriate human oversight for security decisions . Measure and improve detection coverage, precision, false-positive rate, investigation volume, alert latency, data quality and analyst effort
Required Qualifications
Job description provided by Novartis.
View the original posting
