Security Operations Analyst II

full-time•India

Summary

Location

India

Type

full-time

Experience

2-5 years

Company links

Website LinkedIn

About this role

<div class="content-intro"><h2>Why Choose Bottomline?</h2> Are you ready to transform the way businesses pay and get paid? Bottomline is a global leader in business payments and cash management, with over 35 years of experience and moving more than $16 trillion in payments annually. We're looking for passionate individuals to join our team and help drive impactful results for our customers. If you're dedicated to delighting customers and promoting growth and innovation - we want you on our team!</div>Security Operations Analyst II  POSITION SUMMARY  The Security Operations Analyst II is an exciting role within our global Security Operations Center, providing security monitoring, incident analysis, and coordinated response to protect payment processing infrastructure. Based in India, this position delivers critical coverage during India business hours as part of our follow-the-sun model, bridging US and EU teams across time zones.  This role requires strong technical proficiency, clear communication for global coordination, and the ability to independently manage security incidents from detection through resolution. The right candidate brings proven investigative skills and solid operational instincts -- ready to contribute meaningfully while learning the nuances of our environment through hands-on training and shadowing.  KEY RESPONSIBILITIES  Security Monitoring and Analysis  <ul> <li data-leveltext="" data-font="Symbol" data-listid="6" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Monitor SIEM platforms, EDR tools, and network security appliances for indicators of compromise and anomalous activity </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="6" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Triage, investigate, and respond to security alerts -- distinguish true positives from noise through analysis of logs, network traffic, endpoint telemetry, and threat intelligence </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="6" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1">Monitor report mailboxes and escalation queues; assess priority and pivot to investigation or response as needed </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="6" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1">Conduct proactive threat hunting to identify threats that evade automated detection </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="6" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1">Collaborate with IT, network engineering, and application teams during triage to gather context and coordinate response </li> </ul> Incident Response and Coordination  <ul> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Serve as incident coordinator during assigned shifts, orchestrating response across distributed global teams </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Execute containment, eradication, and recovery actions per established playbooks </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1">Coordinate with US and EU personnel during incident handoffs with clear, comprehensive briefings </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1">Engage stakeholders to facilitate system isolation, evidence collection, and remediation </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1">Document incident timelines, actions, and lessons learned per compliance requirements </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="7" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="6" data-aria-level="1">Escalate critical incidents to senior leadership with situation assessments and recommended actions </li> </ul> Global Operations and Process Improvement  <ul> <li data-leveltext="" data-font="Symbol" data-listid="8" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Provide seamless follow-the-sun coverage, participating in daily global SOC briefings </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="8" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Collaborate with security engineering to tune detection rules and reduce false positives </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="8" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1">Refine playbooks, procedures, and documentation based on operational experience </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="8" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1">Stay current with emerging threats and industry best practices in financial services security </li> </ul> QUALIFICATIONS  Experience  <ul> <li data-leveltext="" data-font="Symbol" data-listid="9" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">3-5 years in security operations with progression from junior to intermediate responsibilities </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="9" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Minimum 2 years hands-on incident investigation and response in enterprise environments </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="9" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1">Experience in global or distributed SOC teams with cross-timezone coordination </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="9" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1">Financial services, payment processing, or regulated industry background preferred </li> </ul> Technical Skills  <ul> <li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Strong SIEM proficiency (Splunk, QRadar, Sentinel, or similar) including query development </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">EDR experience (CrowdStrike, Carbon Black, Defender, or SentinelOne) </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1">Network protocol knowledge (TCP/IP, DNS, HTTP/S) and packet analysis skills </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1">Windows and Linux investigation techniques; scripting ability (Python, PowerShell, or Bash) </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="10" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1">Familiarity with MITRE ATT&CK and common attacker TTPs </li> </ul> Education and Certifications  <ul> <li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Bachelor's degree in Computer Science, Cybersecurity, or related field; equivalent experience considered </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="11" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Security certifications (Security+, GCIH, CEH) valued; advanced certs (GCIA, GCFA, CISSP) a plus </li> </ul> Preferred  <ul> <li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Cloud security monitoring experience (AWS, Azure, or GCP) </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">SOAR platform experience; threat intelligence integration </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="12" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1">Digital forensics background; PCI DSS familiarity </li> </ul> CORE COMPETENCIES  <ul> <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="1" data-aria-level="1">Technical Excellence: Thorough investigations and sound conclusions under pressure </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="2" data-aria-level="1">Communication: Exceptional written and verbal English for global coordination and documentation </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="3" data-aria-level="1">Critical Thinking: Synthesizes information from multiple sources; identifies complex attack patterns </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="4" data-aria-level="1">Self-Direction: Works independently with sound judgment on when to escalate </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="13" data-list-defn-props="{"335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"multilevel"}" data-aria-posinset="5" data-aria-level="1">Collaboration: Partners effectively across teams, time zones, and cultures </li> </ul> REPORTING STRUCTURE  Direct Reporting: Senior Manager, Security Operations  WORKING CONDITIONS  This position operates within a 24/7 global Security Operations Center environment based in India, providing coverage that overlaps with US East Coast, US West Coast, and European security teams. Standard working hours align with India business hours (9:00 AM to 6:00 PM IST) with flexibility required for incident response, global team coordination, and critical maintenance activities. The analyst must be available for on-call rotation to support after-hours critical incidents.  New hires will receive structured onboarding including training and shadowing to learn our specific environment, tooling, and operational procedures.  This job description conveys information essential to understanding the scope of the position and is not an exhaustive list of skills, efforts, duties, responsibilities, or working conditions associated with it. Management reserves the right to modify, add, or remove duties as necessary.     <div class="content-conclusion">We welcome talent at all career stages and are dedicated to understanding and supporting additional needs. We're proud to be an equal opportunity employer, committed to creating an inclusive and open environment for everyone.</div>

What you'll do

The Security Operations Analyst II is responsible for security monitoring, incident analysis, and coordinated response to protect payment processing infrastructure. This includes triaging security alerts, conducting threat hunting, and coordinating incident responses across global teams.

About Bottomline

At Bottomline, we help businesses pay and get paid. As a trusted partner to banks, corporates, and financial institutions worldwide, we deliver secure, scalable, and innovative solutions that simplify complex payment workflows, reduce fraud risk, and drive operational efficiency. With decades of expertise in financial messaging, cash management, and digital banking, our SaaS platforms and services are built to meet the evolving needs of modern finance teams. Whether it's automating B2B payments, streamlining compliance, or enabling real-time visibility into cash flow, Bottomline is committed to making business payments seamless and secure. We serve over 1,200 financial institutions and 10,000 businesses globally, helping them navigate the future of payments with confidence.

Ready to join Bottomline?

Take the next step in your career journey

Frequently Asked Questions

What does a Security Operations Analyst II do at Bottomline?

As a Security Operations Analyst II at Bottomline, you will: the Security Operations Analyst II is responsible for security monitoring, incident analysis, and coordinated response to protect payment processing infrastructure. This includes triaging security alerts, conducting threat hunting, and coordinating incident responses across global teams..

Is the Security Operations Analyst II position at Bottomline remote?

The Security Operations Analyst II position at Bottomline is based in India, India. Contact the company through Clera for specific work arrangement details.

How do I apply for the Security Operations Analyst II position at Bottomline?

You can apply for the Security Operations Analyst II position at Bottomline directly through Clera. Click the "Apply Now" button above to start your application. Clera's AI-powered platform will help match your profile with this opportunity and guide you through the application process.

About this role

About Bottomline

Security Operations Analyst II

Summary

Location

Type

Experience

Company links

About this role

What you'll do

About Bottomline

Ready to join Bottomline?

Frequently Asked Questions

What does a Security Operations Analyst II do at Bottomline?

Is the Security Operations Analyst II position at Bottomline remote?

How do I apply for the Security Operations Analyst II position at Bottomline?

Security Operations Analyst II

Summary

Location

Type

Experience

Company links

About this role

What you'll do

About Bottomline

Ready to join Bottomline?

Frequently Asked Questions

What does a Security Operations Analyst II do at Bottomline?

Is the Security Operations Analyst II position at Bottomline remote?

How do I apply for the Security Operations Analyst II position at Bottomline?

Join Clera's Talent Pool

Join Clera's Talent Pool