CC - SE/ SOC - Defender/L2

Role Summary

• The SOC Level 2 Analyst is responsible for advanced security event analysis, incident response, and threat hunting
• This role involves working with cutting-edge security tools, including Microsoft Defender suite, to protect organizational assets
• Key Responsibilities
• Advanced Alert Analysis: Validate and investigate escalated alerts from L1 using SIEM and EDR tools
• Incident Response: Execute containment, eradication, and recovery steps for confirmed incidents
• Threat Hunting: Proactively search for indicators of compromise across endpoints and networks
• Microsoft Defender Expertise: Use Microsoft Defender for Endpoint for malware detection and remediation
• Monitor and respond to alerts in Microsoft Defender for Identity and Defender for Office 365
• Configure and optimize Microsoft Security Center dashboards
• Tool Integration: Work with Azure Sentinel, Splunk, QRadar, and SOAR platforms for automation
• Forensics & Malware Analysis: Perform deep-dive investigations using sandboxing and forensic tools
• Playbook Development: Update incident response workflows and automation scripts
• Reporting & Compliance: Document incidents and prepare reports for audits
• Required Tools & Technologies
• SIEM: Azure Sentinel, Splunk, QRadar
• EDR: Microsoft Defender for Endpoint, CrowdStrike, Carbon Black
• Threat Intelligence: MISP, Recorded Future
• SOAR: Palo Alto Cortex XSOAR, Microsoft Sentinel Automation
• Network Security: IDS/IPS (Snort, Suricata), Firewalls
• Cloud Security: Microsoft Defender for Cloud, AWS GuardDuty
• Scripting: Python, PowerShell for automation Skills & Qualifications
• Strong knowledge of MITRE ATT\&CK framework
• Hands-on experience with Microsoft Defender suite
• Familiarity with incident response lifecycle and digital forensics

Certifications: Microsoft SC-200, CompTIA Security+, CEH, CISSP (preferred).