SOC Analyst L2
Full time · Posted 6D AGO
Senior SOC Analyst (L2/L3)
Experience: 4-6 years | Department: Infosec
Roles and Responsibilities:• Perform real-time monitoring, security incident handling, analysis, and escalation of securityevents from multiple log sources.• Second-level investigation of alerts triggered by security controls such as endpoints, emailgateway, antivirus, and firewalls.
• Lead end-to-end incident response: analysis, containment, eradication, recovery, and post-incident reporting.
• Perform advanced phishing and malware analysis.• Handle escalations from L1 and stakeholders, and address queries and requests through callsand emails.• Use the SIEM tool to document security breaches and responses daily.• Create reports and charts for easy understanding of detected suspicious activity.• Administer the SIEM platform, including user and role management, license management,health monitoring, and upgrades.• Onboard log sources from different machines and devices, and troubleshoot log collection andparsing issues.• Work on the implementation of new systems into the SIEM and troubleshoot servers.• Maintain and tune DLP policies and incident workflows.• Manage vulnerability scanning and patch management cycles.• Create, test, and tune SIEM correlation rules, alerts, and use cases mapped to MITRE ATT&CK.• Reduce false positives through rule tuning, whitelisting, and threshold optimization.• Build dashboards, reports, and automated response playbooks.• Perform threat hunting using logs and threat intelligence to close detection gaps.• Mentor junior analysts and maintain SOPs and runbooks.• Work as part of a team to ensure corporate data and technology platform components aresafeguarded from known threats.
Preferred Qualifications:• 4-6 years of experience with a Bachelor's/Master's degree in Computer Science, Math, or arelated technical domain from reputed organizations.• Should have worked on SIEM tools like QRadar, LogRhythm, sentinelone, Log360 (includingadministration and correlation rule creation) and endpoint security like EDR, XDR(CrowdStrike, SentinelOne).• Should have knowledge of any DLP solution from any vendor.• Should have experience writing SIEM queries, regex, and log parsers; scripting in Python orPowerShell is an added advantage.• Certifications such as CEH, CHFI, GCIH, Security+
Experience: 4-6 years | Department: Infosec
Roles and Responsibilities:• Perform real-time monitoring, security incident handling, analysis, and escalation of securityevents from multiple log sources.• Second-level investigation of alerts triggered by security controls such as endpoints, emailgateway, antivirus, and firewalls.
• Lead end-to-end incident response: analysis, containment, eradication, recovery, and post-incident reporting.
• Perform advanced phishing and malware analysis.• Handle escalations from L1 and stakeholders, and address queries and requests through callsand emails.• Use the SIEM tool to document security breaches and responses daily.• Create reports and charts for easy understanding of detected suspicious activity.• Administer the SIEM platform, including user and role management, license management,health monitoring, and upgrades.• Onboard log sources from different machines and devices, and troubleshoot log collection andparsing issues.• Work on the implementation of new systems into the SIEM and troubleshoot servers.• Maintain and tune DLP policies and incident workflows.• Manage vulnerability scanning and patch management cycles.• Create, test, and tune SIEM correlation rules, alerts, and use cases mapped to MITRE ATT&CK.• Reduce false positives through rule tuning, whitelisting, and threshold optimization.• Build dashboards, reports, and automated response playbooks.• Perform threat hunting using logs and threat intelligence to close detection gaps.• Mentor junior analysts and maintain SOPs and runbooks.• Work as part of a team to ensure corporate data and technology platform components aresafeguarded from known threats.
Preferred Qualifications:• 4-6 years of experience with a Bachelor's/Master's degree in Computer Science, Math, or arelated technical domain from reputed organizations.• Should have worked on SIEM tools like QRadar, LogRhythm, sentinelone, Log360 (includingadministration and correlation rule creation) and endpoint security like EDR, XDR(CrowdStrike, SentinelOne).• Should have knowledge of any DLP solution from any vendor.• Should have experience writing SIEM queries, regex, and log parsers; scripting in Python orPowerShell is an added advantage.• Certifications such as CEH, CHFI, GCIH, Security+
