SOC Analyst - L2

SOC Analyst - L2

Role Overview

The SOC Analyst L2 is responsible for
advanced threat detection, incident investigation, threat hunting, malware
analysis, security incident response, and continuous improvement of security
monitoring capabilities. This role serves as the primary escalation point for
L1 analysts and plays a key role in strengthening the organization's cyber
defense posture.

Key Responsibilities

Incident Response & Investigation

- Investigate escalated security incidents and validate true
positives.
- Perform root cause analysis and impact assessment.
- Lead containment, eradication, and recovery activities.
- Conduct detailed forensic investigations on endpoints and
systems.
- Coordinate with IT, Cloud, Network, and Security Engineering
teams during major incidents.

Threat Hunting

- Proactively identify emerging threats and hidden adversary
activities.
- Develop threat hunting hypotheses using MITRE ATT&CK
Framework.
- Identify attacker tactics, techniques, and procedures (TTPs).
- Utilize threat intelligence feeds to improve detection
capabilities.

SIEM & Detection Engineering

- Tune and optimize SIEM correlation rules.
- Develop new threat detection use cases.
- Reduce false positives through continuous rule enhancement.
- Improve detection coverage across cloud, endpoints, network,
and identity platforms.

Cloud Security Operations

- Monitor and investigate security events across Azure and AWS
environments.
- Analyze IAM anomalies, privilege escalations, and cloud
misconfigurations.
- Support cloud-native security tools and security posture
management platforms.

Endpoint & Malware Analysis

- Perform malware investigation and behavioral analysis.
- Analyze EDR/XDR detections.
- Conduct IOC and IOA investigations.
- Support ransomware response activities.

Technical Skills

SIEM Platforms

- Microsoft Sentinel
- Splunk Enterprise Security
- IBM QRadar
- LogRhythm

Endpoint & XDR Security

- Microsoft Defender XDR
- CrowdStrike Falcon
- SentinelOne
- Cortex XDR

Threat Hunting & Incident Response

- MITRE ATT&CK Framework
- Cyber Kill Chain
- Threat Intelligence Platforms
- IOC/IOA Analysis
- Digital Forensics

Cloud Security

- Microsoft Azure Security
- AWS Security Services
- Cloud Security Posture Management (CSPM)
- Identity Security Monitoring

Security Controls

- WAF
- CASB
- DLP
- Email Security
- Zero Trust Security Architecture
- Zscaler Security Monitoring (Preferred)

Shift & Scheduling

- 24x7 Security Operations Coverage
- On-call Support for Critical Incidents
- Major Incident Management Participation
- Support During Security Breach Investigations

Preferred Certifications

- Microsoft SC-200 Security Operations Analyst
- CompTIA CySA+
- CEH (Certified Ethical Hacker)
- Splunk Enterprise Security Administrator

Cloud & Security Certifications

- Microsoft Azure Security Engineer (AZ-500)
- AWS Security Specialty
- Google Professional Cloud Security Engineer

Zscaler Certifications (Preferred)

- Zscaler Certified Administrator (ZCCA-IA)
- Zscaler Certified Security Administrator
- Zscaler Certified Cloud Administrator
- Zscaler Internet Access (ZIA) Administration Experience