SOC Analyst L2

Senior SOC Analyst (L2/L3)
Experience: 4-6 years | Department: Infosec
Roles and Responsibilities: • Perform real-time monitoring, security incident handling, analysis, and escalation of security events from multiple log sources. • Second-level investigation of alerts triggered by security controls such as endpoints, email gateway, antivirus, and firewalls.
• Lead end-to-end incident response: analysis, containment, eradication, recovery, and post- incident reporting.
• Perform advanced phishing and malware analysis. • Handle escalations from L1 and stakeholders, and address queries and requests through calls and emails. • Use the SIEM tool to document security breaches and responses daily. • Create reports and charts for easy understanding of detected suspicious activity. • Administer the SIEM platform, including user and role management, license management, health monitoring, and upgrades. • Onboard log sources from different machines and devices, and troubleshoot log collection and parsing issues. • Work on the implementation of new systems into the SIEM and troubleshoot servers. • Maintain and tune DLP policies and incident workflows. • Manage vulnerability scanning and patch management cycles. • Create, test, and tune SIEM correlation rules, alerts, and use cases mapped to MITRE ATT&CK. • Reduce false positives through rule tuning, whitelisting, and threshold optimization. • Build dashboards, reports, and automated response playbooks. • Perform threat hunting using logs and threat intelligence to close detection gaps. • Mentor junior analysts and maintain SOPs and runbooks. • Work as part of a team to ensure corporate data and technology platform components are safeguarded from known threats.
Preferred Qualifications: • 4-6 years of experience with a Bachelor's/Master's degree in Computer Science, Math, or a related technical domain from reputed organizations. • Should have worked on SIEM tools like QRadar, LogRhythm, sentinelone, Log360 (including administration and correlation rule creation) and endpoint security like EDR, XDR (CrowdStrike, SentinelOne). • Should have knowledge of any DLP solution from any vendor. • Should have experience writing SIEM queries, regex, and log parsers; scripting in Python or PowerShell is an added advantage. • Certifications such as CEH, CHFI, GCIH, Security+