SOC Analyst L2

Key Responsibilities

Incident Monitoring & Analysis

• Monitor security alerts using SIEM tools such as Splunk, IBM QRadar, or Microsoft Sentinel
• Analyze and triage security alerts escalated from L1 analysts
• Investigate suspicious activities and determine severity levels

Incident Response

• Perform detailed investigation of security incidents
• Conduct root cause analysis and recommend remediation steps
• Contain and eradicate threats such as malware, phishing, and ransomware
• Escalate complex incidents to L3 or Incident Response teams when required

Threat Detection & Hunting

• Assist in threat hunting activities using MITRE ATT&CK framework
• Tune and optimize SIEM correlation rules to reduce false positives
• Identify emerging threats and vulnerabilities

Reporting & Documentation

• Document incidents, findings, and remediation actions
• Prepare incident reports and executive summaries
• Maintain updated playbooks and runbooks

Collaboration

• Work closely with IT, Network, and Infrastructure teams
• Support vulnerability management and patching initiatives
• Participate in 24/7 SOC shift rotation (if applicable)

Required Skills & Qualifications

• 36 years of experience in SOC / Cybersecurity
• Hands-on experience with SIEM tools (Splunk, QRadar, Sentinel)
• Experience with EDR tools like CrowdStrike or Microsoft Defender
• Strong understanding of TCP/IP, Firewalls, IDS/IPS
• Knowledge of incident response lifecycle
• Familiarity with ISO 27001 / NIST frameworks
• Strong analytical and problem-solving skills