SOC Analyst L2

About the Role

We are looking for an experienced SOC Analyst L2 to investigate escalated security incidents, perform threat hunting, conduct root-cause analysis, and develop detection use cases. The candidate should have strong hands-on experience with SIEM platforms, incident response, log analysis, and security monitoring.

Key Responsibilities

• Investigate and resolve incidents escalated by L1 analysts.
• Perform threat hunting across endpoint, network, identity, and cloud logs.
• Analyze indicators of compromise (IOCs), suspicious processes, malicious IPs, and unusual authentication activity.
• Conduct incident scoping, root-cause analysis, and impact assessment.
• Develop, tune, and test SIEM detection rules and correlation searches.
• Create new detection use cases to address emerging threats and monitoring gaps.
• Reduce false positives and improve alert quality.
• Coordinate with infrastructure, network, endpoint, and identity teams during investigations.
• Maintain incident reports, technical documentation, and response timelines.
• Support security frameworks, compliance requirements, and SOC process improvements.
• Mentor L1 analysts and improve triage and escalation procedures.

Requirements & Tech Stack

• Strong SIEM experience, preferably Splunk or another enterprise SIEM.
• Threat hunting and advanced log analysis.
• Incident investigation, containment coordination, and response.
• Detection engineering and use-case development.
• Knowledge of endpoint, network, identity, and cloud security events.
• Incident reporting, root-cause analysis, and stakeholder communication.

Qualifications

Preferred Certifications: CISSP, CompTIA Security+, or other relevant cybersecurity certifications.