SOC Analyst L2

Senior SOC Analyst (L2/L3)

Experience: 4-6 years | Department: Infosec

Roles and Responsibilities:

Perform real-time monitoring, security incident handling, analysis, and escalation of security

events from multiple log sources.

Second-level investigation of alerts triggered by security controls such as endpoints, email

gateway, antivirus, and firewalls.

Lead end-to-end incident response: analysis, containment, eradication, recovery, and post-

incident reporting.

Perform advanced phishing and malware analysis.

Handle escalations from L1 and stakeholders, and address queries and requests through calls

and emails.

Use the SIEM tool to document security breaches and responses daily.

Create reports and charts for easy understanding of detected suspicious activity.

Administer the SIEM platform, including user and role management, license management,

health monitoring, and upgrades.

Onboard log sources from different machines and devices, and troubleshoot log collection and

parsing issues.

Work on the implementation of new systems into the SIEM and troubleshoot servers.

Maintain and tune DLP policies and incident workflows.

Manage vulnerability scanning and patch management cycles.

Create, test, and tune SIEM correlation rules, alerts, and use cases mapped to MITRE ATT&CK.

Reduce false positives through rule tuning, whitelisting, and threshold optimization.

Build dashboards, reports, and automated response playbooks.

Perform threat hunting using logs and threat intelligence to close detection gaps.

Mentor junior analysts and maintain SOPs and runbooks.

Work as part of a team to ensure corporate data and technology platform components are

safeguarded from known threats.

Preferred Qualifications:

4-6 years of experience with a Bachelor's/Master's degree in Computer Science, Math, or a

related technical domain from reputed organizations.

Should have worked on SIEM tools like QRadar, LogRhythm, sentinelone, Log360 (including

administration and correlation rule creation) and endpoint security like EDR, XDR

(CrowdStrike, SentinelOne).

Should have knowledge of any DLP solution from any vendor.

Should have experience writing SIEM queries, regex, and log parsers; scripting in Python or

PowerShell is an added advantage.

Certifications such as CEH, CHFI, GCIH, Security+