Position Overview
We are seeking a skilled and detail-oriented L2 / L2.5 Security Operations Center (SOC) Analyst to join our Security Operations team. This role sits at the critical intersection of threat detection, incident investigation, and escalation management. The successful candidate will be responsible for identifying, investigating, and responding to security threats while mentoring L1 analysts and collaborating with senior security teams.
Position Type : Full-time
Location : (On-site / Hybrid / Remote)
Experience Level : 8 years in cybersecurity / SOC operations.
Key Responsibilities
Tier 2 Incident Analysis & Investigation (45%)
Alert Triage & Investigation :
- Analyze and investigate alerts / incidents escalated from L1 analysts
- Determine incident severity, scope, and impact on business operations
- Conduct root cause analysis for security events and anomalies
- Perform deep-dive forensic analysis on suspicious activities
- Create detailed incident investigation reports with findings and recommendations
Threat Assessment :
Classify and categorize threats (malware, ransomware, APT, credential theft, data exfiltration, etc.)Evaluate threat credibility and validate true positives vs. false positivesAssess threat actor capabilities, tactics, techniques, and procedures (TTPs)Determine data exposure and potential impact on organizationIncident Containment & Response :
Execute immediate containment measures to prevent threat propagationIsolate affected systems from network when necessaryCoordinate with IT Operations for system remediation and recoveryRecommend and implement mitigation strategiesParticipate in incident response playbook executionSIEM & Security Tool Management (25%)
SIEM Platform Operations :
Monitor and manage SIEM (Security Information and Event Management) platformCreate, modify, and optimize detection rules and correlation searchesDevelop custom dashboards and reports for security monitoringTune alert thresholds to reduce false positives while maintaining detection sensitivityMaintain SIEM data integrity and log ingestion from all security sourcesSecurity Tool Administration :
Manage and maintain EDR (Endpoint Detection & Response) solutionsMonitor firewall logs, IDS / IPS alerts, and network anomaliesReview and escalate VPN access anomalies and unusual traffic patternsManage DLP (Data Loss Prevention) incidents and policy violationsMonitor and respond to vulnerability scanner findings and exploit attemptsLog Analysis & Threat Hunting :
Perform manual log analysis to identify suspicious patterns and anomaliesConduct proactive threat hunting campaigns based on threat intelligenceSearch for indicators of compromise (IOCs) across infrastructureAnalyze logs from Windows / Linux systems, applications, and network devicesCreate hunt packages and queries for recurring threat patternsEscalation & Ticket Management (15%)
Alert Routing & Escalation :
Escalate incidents to L3 analysts and specialized teams (incident response, forensics, threat intelligence)Determine appropriate escalation path based on incident severity and typeProvide clear handoff documentation to specialized teamsMonitor ticket status through resolutionPerform quality assurance on closed ticketsTicket Management :
Document all investigations in ticketing system with comprehensive notesMaintain incident timeline and evidence chain of custodyUpdate incident status and metrics trackingMeet SLA requirements for investigation and escalation (typically 4-8 hours for critical incidents)Generate metrics reports for team and management reviewL1 Analyst Support & Mentoring (10%)
Knowledge Transfer :
Mentor L1 analysts on investigation techniques and proceduresReview L1 investigations and provide feedback for improvementCreate runbooks and playbooks for common incident typesConduct training sessions on new threats, tools, and proceduresShare threat intelligence and best practices with SOC teamQuality Assurance :
Review L1 alert dispositions and investigation qualityIdentify gaps in L1 knowledge and provide targeted trainingValidate that proper procedures are followedSuggest process improvements based on L1 experiencesTechnical Competencies
Required Skills (Must Have)
Security Operations :
3-5 years experience in SOC, threat detection, or incident responseProficiency with SIEM platforms (Splunk, Arc Sight, QRadar, or similar)Hands-on experience with EDR solutions (Crowd Strike, Microsoft Defender, Sentinel One)Strong understanding of security frameworks (MITRE ATT&CK, NIST Cybersecurity Framework)Knowledge of incident response processes and proceduresExperience with security monitoring tools and techniquesTechnical Knowledge :
Strong understanding of networking (TCP / IP, DNS, HTTP / HTTPS, VPN, firewalls)Windows and Linux system administration fundamentalsKnowledge of common attack vectors and threat landscapeAbility to read and interpret logs (Windows Event Logs, Syslog, firewall logs, web logs)Understanding of malware analysis concepts (static vs. dynamic analysis)Basic scripting knowledge (Python, Bash, or Power Shell) for automation tasksAnalytical Skills :
Excellent analytical and problem-solving abilitiesStrong attention to detail and accuracyAbility to work through complex investigations methodicallyData-driven decision makingPattern recognition and anomaly detection capabilitiesCommunication & Documentation :
Excellent written communication for incident reports and escalationsAbility to clearly explain technical findings to non-technical stakeholdersStrong documentation and note-taking practicesClear verbal communication with team members and other departmentsDesired Skills (Nice to Have)
Threat Intelligence : Experience consuming and applying threat intelligenceAdvanced Forensics : Digital forensics or malware analysis experienceAutomation : Experience with Python, Ansible, or similar for playbook automationCloud Security : Experience with AWS, Azure, or GCP security monitoringCertifications : GIAC Security Essentials (GSEC), CEH, Security+, CISSP, or similarIncident Response : Prior incident response team experienceVulnerability Management : Experience with vulnerability assessment and remediationCompliance : Knowledge of compliance frameworks (PCI-DSS, HIPAA, SOC 2, ISO 27001