SOC Analyst - L2

Role Overview

The SOC Analyst L2 is responsible foradvanced threat detection, incident investigation, threat hunting, malwareanalysis, security incident response, and continuous improvement of securitymonitoring capabilities. This role serves as the primary escalation point forL1 analysts and plays a key role in strengthening the organization's cyberdefense posture.

Key Responsibilities

Incident Response & Investigation

Investigate escalated security incidents and validate true positives.
Perform root cause analysis and impact assessment.
Lead containment, eradication, and recovery activities.
Conduct detailed forensic investigations on endpoints and systems.
Coordinate with IT, Cloud, Network, and Security Engineering teams during major incidents.

Threat Hunting

Proactively identify emerging threats and hidden adversary activities.
Develop threat hunting hypotheses using MITRE ATT&CK Framework.
Identify attacker tactics, techniques, and procedures (TTPs).
Utilize threat intelligence feeds to improve detection capabilities.

SIEM & Detection Engineering

Tune and optimize SIEM correlation rules.
Develop new threat detection use cases.
Reduce false positives through continuous rule enhancement.
Improve detection coverage across cloud, endpoints, network, and identity platforms.

Cloud Security Operations

Monitor and investigate security events across Azure and AWS environments.
Analyze IAM anomalies, privilege escalations, and cloud misconfigurations.
Support cloud-native security tools and security posture management platforms.

Endpoint & Malware Analysis

Perform malware investigation and behavioral analysis.
Analyze EDR/XDR detections.
Conduct IOC and IOA investigations.
Support ransomware response activities.

Technical Skills

SIEM Platforms

Microsoft Sentinel
Splunk Enterprise Security
IBM QRadar
LogRhythm

Endpoint & XDR Security

Microsoft Defender XDR
CrowdStrike Falcon
SentinelOne
Cortex XDR

Threat Hunting & Incident Response

MITRE ATT&CK Framework
Cyber Kill Chain
Threat Intelligence Platforms
IOC/IOA Analysis
Digital Forensics

Cloud Security

Microsoft Azure Security
AWS Security Services
Cloud Security Posture Management (CSPM)
Identity Security Monitoring

Security Controls

WAF
CASB
DLP
Email Security
Zero Trust Security Architecture
Zscaler Security Monitoring (Preferred)

Shift & Scheduling

24x7 Security Operations Coverage
On-call Support for Critical Incidents
Major Incident Management Participation
Support During Security Breach Investigations

Preferred Certifications

Microsoft SC-200 Security Operations Analyst
CompTIA CySA+
CEH (Certified Ethical Hacker)
Splunk Enterprise Security Administrator

Cloud & Security Certifications

Microsoft Azure Security Engineer (AZ-500)
AWS Security Specialty
Google Professional Cloud Security Engineer

Zscaler Certifications (Preferred)

Zscaler Certified Administrator (ZCCA-IA)
Zscaler Certified Security Administrator
Zscaler Certified Cloud Administrator
Zscaler Internet Access (ZIA) Administration Experience

Learn more about this Employer on their Career Site