SOC Analyst - L2

Job Title: Microsoft Sentinel SOC Analyst L2

Experience: 3+ years

Location: Bangalore – Work from Office

Job Summary:

Seeking a skilled Microsoft Sentinel SOC L2 Analyst with a minimum of 3+ years of experience in cybersecurity and cloud security principles. The ideal candidate will have hands-on expertise in Microsoft Sentinel, including playbook creation, KQL querying for custom analytics and hunting, and compliance-focused workbook development. This role requires strong problem-solving skills with experience in incident handling, remediation, and RCA reporting, particularly in real-time compromised security scenarios.

Key Responsibilities:

• Monitor, investigate, and respond to security alerts and incidents using Microsoft Sentinel, focusing on high-severity cases.
• Create, tune, and maintain custom analytic rules, hunting queries, and workbooks to meet customer compliance and security requirements using Kusto Query Language (KQL).
• Develop and manage automated response playbooks integrating with Sentinel to streamline incident response workflows.
• Collaborate with compliance teams to design and implement workbooks addressing regulatory requirements (e.g., GDPR, HIPAA, PCI-DSS).
• Lead remediation activities for critical security incidents and prepare detailed Root Cause Analysis (RCA) reports.
• Engage in threat hunting and proactive security research to identify emerging threats and improve detection capabilities.
• Participate in escalation management and provide subject matter expertise during compromised or high-impact security events.
• Maintain and update documentation on incident response procedures, detection rules, and compliance frameworks.
• Work closely with cross-functional teams to enhance the overall security posture of customer environments.

Required Qualifications:

• Minimum 3+ years of experience in a SOC analyst role or equivalent, with a focus on Microsoft Sentinel.
• Strong knowledge of cybersecurity fundamentals, cloud security principles (especially Azure), and compliance frameworks.
• Hands-on experience creating and managing Azure Sentinel playbooks using Logic Apps or other automation tools.
• Proficient in Kusto Query Language (KQL) for crafting custom analytic and hunting queries as well as compliance workbooks.
• Experience handling severe security alerts, conducting incident investigations, and leading remediation efforts.
• Skilled in writing clear, comprehensive RCA reports and communicating findings to technical and non-technical stakeholders.
• Solid understanding of compliance standards and ability to translate regulatory requirements into actionable security measures.
• Excellent analytical, troubleshooting, and communication skills.

Preferred Qualifications:

• Certifications such as Microsoft Certified: Security Operations Analyst Associate (SC-200), Azure Security Engineer (AZ-500), or any other related certifications.
• Experience working in real-time compromised scenarios and managing complex security events.
• Familiarity with additional security tools such as Defender for Cloud, Defender for Endpoint, or third-party SIEM solutions.
• Scripting skills (PowerShell, Python) for automation and custom