Job Summary:
We are seeking a highly experienced Level 3 Threat & Incident Response Analyst to lead advanced incident investigations, threat hunting, and detection engineering using Microsoft Sentinel. This role focuses on strengthening SOC capabilities, automation, and overall security posture.
Key Responsibilities
Key Responsibilities:
- Lead investigation and response for high-severity and complex security incidents
- Act as escalation point for L1/L2 analysts and provide technical guidance
- Perform advanced threat hunting using KQL, MITRE ATT&CK;, and threat intelligence
- Design, develop, and optimize Sentinel analytics rules and detection use cases
- Build and maintain SOAR playbooks using Azure Logic Apps
- Integrate Sentinel with enterprise tools (EDR, IAM, Firewalls, ITSM)
- Conduct detection gap analysis and improve monitoring coverage
- Perform root cause analysis (RCA) and recommend remediation strategies
- Lead incident response bridge calls and stakeholder communication
- Develop SOPs, runbooks, and SOC best practices
- Mentor L1/L2 teams and drive SOC maturity initiatives
Skill Requirements
Required Skills:
- Expert-level experience with Microsoft Sentinel
- Advanced KQL query writing and optimization
- Strong understanding of incident response lifecycle and threat hunting
- Deep knowledge of MITRE ATT&CK; and adversary techniques
- Experience with log correlation across identity, endpoint, network, and cloud
- Strong analytical, investigative, and troubleshooting skills
Other Requirements
Good to Have:
- Experience with Defender XDR suite
- Knowledge of automation using PowerShell/Python
- Experience in cloud security monitoring (Azure/AWS)
Certifications (Preferred):
- Microsoft SC-200
- AZ-500 / CISSP / GCIH
Soft Skills:
- Solid leadership and stakeholder management
- Excellent communication and reporting skills
- Ability to handle critical incidents under pressure
- Mentoring and team development