Security Analyst - L2

Introduction

Introduction*A career in IBM Consulting is rooted by long-term relationships and close collaboration with clients across the globe.You'll work with visionaries across multiple industries to improve the hybrid cloud and AI journey for the most innovative and valuable companies in the world. Your ability to accelerate impact and make meaningful change for your clients is enabled by our strategic partner ecosystem and our robust technology platforms across the IBM portfolio; including Software and Red Hat.Curiosity and a constant quest for knowledge serve as the foundation to success in IBM Consulting. In your role, you'll be encouraged to challenge the norm, investigate ideas outside of your role, and come up with creative solutions resulting in ground breaking impact for a wide network of clients. Our culture of evolution and empathy centers on long-term career growth and development opportunities in an environment that embraces your unique skills and experience.

Your Role And Responsibilities

Roles & Responsibilities:

• Handling alerts and incident on XDR platform
• Alert & incident triage and analysis
• Proactively investigating suspicious activities
• Log all findings, actions taken, and escalations clearly in the XDR and ITSM platform
• Execute predefined actions such as isolating blocking IPs or disabling user accounts, based on set protocols.
• Adhere to established policies, procedures, and security practices.
• Follow-up with tech team for incident closure
• Participating in daily standup and review meeting
• L2 Analyst has responsibility to closely track the incidents and support for closure.
• Working with logsource and usecase management in integrating log sources and developing & testing usecase
• Work & support on multiple cybersecurity tool (DLP, GRC, Cloudsec tool, DAM)
• Developing SOP / instruction manual for L1 team
• Guiding L1 team for triage/analysis and assist in clousure of cybersecurity alert and incidents
• Handle XDR alerts and followup with customer team for agent updates
• Escalate more complex incidents to L3 SME for deeper analysis.
  

Key Responsibilities

Security Monitoring & Incident Response GovernanceDefine and maintain security monitoring, threat detection, and incident response policies and procedures.Establish and mature a threat intelligence program, incorporating tactical and strategic threat feeds.Align SOC operations with evolving business risk priorities and regulatory frameworks.Platform & Toolset ManagementEvaluate, implement, and enhance SIEM platforms, ensuring optimal log ingestion, correlation, and rule effectiveness.Assess and manage deployment of EDR, XDR, SOAR, and Threat Intelligence solutions.Maintain and update incident response playbooks and automation workflows.Ensure consistent platform hygiene and technology stack effectiveness across SOC tooling.SOC Operations & Threat DetectionOversee 24x7 monitoring of security events and alerts across enterprise assets.Lead and coordinate proactive threat hunting across networks, endpoints, and cloud.Manage and support forensic investigations to identify root cause and recovery paths.Govern use case development, log source onboarding, and alert/event triage processes.Regulatory Compliance & Incident ManagementEnsure timely and accurate incident reporting in compliance with RBI, CERT-In, and other authorities.Retain logs in accordance with regulatory data retention mandates.Enforce and monitor security baselines for endpoints, in line with internal and regulatory standards.Advanced Threat Management & ReportingPlan, conduct, and report on Red Teaming and Purple Teaming exercises to test detection and response capabilities.Participate in and contribute to the Risk Operations Committee (ROC) meetings and initiatives.Review and track SOC effectiveness through KPIs, metrics, and regular reporting dashboards.

Preferred Education

Master's Degree

Required Qualifications

Required technical and professional expertise

Bachelor’s or Master’s degree in Cybersecurity, Computer Science, or related field.3-7 years of experience in SOC management, incident response, or cyber threat detection roles.Hands-on expertise with SIEM (e.g., Splunk, QRadar, Sentinel), EDR/XDR tools, and SOAR platforms.Proven experience in playbook development, forensics, and threat hunting methodologies.Strong understanding of RBI/CERT-In incident reporting guidelines and log retention requirements.Familiarity with MITRE ATT&CK, threat modeling, and adversary emulation techniques.

Preferred Certifications

Preferred technical and professional experience

GCIA, GCIH, GCFA, CISSP, OSCP, CEH, CHFI, or similar certifications