Job Description: SOC L2 Analyst
The SOC L2 Analyst plays a crucial role in safeguarding our organization's information systems by investigating, analyzing, and resolving security incidents. This position is essential for maintaining the integrity and security of our digital assets, ensuring effective incident response, and collaborating with both internal and customer teams.
Key Responsibilities
- Advanced Alert Investigation & Analysis
- Investigate and analyze security alerts escalated by the L1 SOC team.
- Correlate events across multiple security devices, logs, and monitoring platforms to identify potential threats.
- Differentiating between genuine security incidents, false positives, and suspicious activities.
- Perform detailed analysis of network, system, and security events.
- Incident Response & Triage
- Take ownership of security incidents escalated by L1.
- Assess the severity, impact, and scope of incidents and prioritize them accordingly.
- Perform root-cause analysis and recommend appropriate containment and remediation actions.
- Escalate critical or complex incidents to L3/Incident Response teams as required.
- Threat Hunting
- Proactively identify suspicious activities, indicators of compromise (IOCs), and potential threats.
- Analyze historical logs and security events to identify attack patterns and recurring threats.
- Support threat-hunting activities based on emerging vulnerabilities and threat intelligence.
- SIEM & Security Tool Management
- Work extensively with SIEM and other security monitoring tools for investigation and correlation.
- Develop and fine-tune correlation rules/use cases to improve alert accuracy.
- Identify gaps in monitoring and recommend improvements.
- Monitor the health and effectiveness of security monitoring tools.
- Vulnerability & Threat Management
- Analyze identified vulnerabilities and assess their potential security impact.
- Coordinate with relevant teams for remediation and closure of security issues.
- Track recurring vulnerabilities and security threats and provide recommendations.
- Incident Documentation & Reporting
- Maintain detailed incident records, investigation findings, actions taken, and resolutions.
- Prepare incident reports and RCA reports for significant security incidents.
- Maintain and update SOPs, playbooks, and knowledge documents for recurring incidents.
- Customer & Internal Coordination
- Communicate with customer IT/security teams regarding ongoing incidents and investigation findings.
- Provide timely updates on incident status, impact, and recommended actions.
- Coordinate with network, system, infrastructure, and security teams for incident resolution.
- L1 Support & Mentoring
- Guide and support L1 SOC analysts in alert investigation and incident handling.
- Review escalated incidents and provide feedback to improve the quality of L1 analysis.
- Support the team in developing better monitoring and incident-handling practices.
- Security Monitoring & Compliance
- Ensure security monitoring activities are performed in accordance with defined SOPs and security standards.
- Support compliance and audit requirements by providing relevant security logs, reports, and documentation.
- Participate in periodic security reviews and improvement initiatives.
- Continuous Learning
- Stay updated on the latest cybersecurity threats, attack techniques, vulnerabilities, and industry best practices.
- Participate in security training, knowledge-sharing sessions, and professional development activities.
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 2–5 years of relevant experience in SOC / Security Operations.
- Professional certifications such as CEH, CompTIA Security+, CySA+, or equivalent are preferred.
- Hands-on experience with SIEM tools and security monitoring platforms.
- Strong understanding of network security, firewalls, VPNs, IDS/IPS, and endpoint security.
- Experience handling and investigating security incidents escalated from L1.
Skills
- Strong incident investigation and analytical skills.
- Good understanding of TCP/IP, DNS, HTTP/HTTPS, routing, switching, and network security concepts.
- Knowledge of Windows and Linux operating systems and their security logs.
- Ability to perform log analysis and event correlation.
- Understanding of common cyber threats, attack techniques, malware, phishing, brute-force attacks, and suspicious network activities.
- Knowledge of IOC analysis and threat-hunting concepts.
- Strong problem-solving and decision-making skills.
- Ability to work effectively under pressure and handle critical security incidents.
- Good written and verbal communication skills.
- Strong coordination and collaboration skills.
- Ability to guide L1 analysts and work effectively within a SOC team.
Work Environment
Our organization fosters a collaborative and innovative work environment, where team members are encouraged to share ideas and contribute to the overall security posture. We utilize cutting-edge tools and technologies to ensure our security operations are efficient and effective.
