Role
Overview

The SOC L2
Analyst is responsible for in-depth security investigation, incident analysis,
and response coordination across enterprise environments. This role focuses on
correlating multi-domain telemetry (SIEM, EDR/XDR, Cloud, DLP, DAM, Email
Security) to determine root cause, assess impact, and recommend containment
actions. The analyst acts as a technical escalation point for L1 and
contributes to improving detection use cases and SOC maturity.

​

Key
Responsibilities

- Perform
deep-dive investigations on alerts from across SIEM, EDR/XDR, Cloud, DLP, DAM,
and Email Security tools

- Correlate
logs and telemetry to reconstruct attack timelines and identify root cause

- Investigate
advanced threats such as lateral movement, privilege escalation, account
compromise, and malware activity

- Conduct
endpoint analysis (process injection, persistence mechanisms, suspicious
binaries, command-line artifacts)

- Analyze cloud
security incidents (Azure/AWS) including IAM misuse, impossible travel, token
abuse, and misconfigurations

- Perform
advanced phishing and BEC investigations, including header analysis, URL
detonation, and payload inspection

- Investigate
DLP (Netskope) alerts for potential data exfiltration, policy violations, and
insider threats

- Analyze data
movement patterns across endpoints, email, and cloud storage

- Tune and
validate DLP policies to reduce false positives and improve detection accuracy

- Investigate
DAM alerts for unauthorized database access, privilege misuse, abnormal query
patterns, and potential SQL injection attempts

- Correlate
database activity with user identity and endpoint behavior to detect malicious
intent

- Lead incident




investigation and provide containment/remediation recommendations

- Create and
enrich IOCs (IP, domain, hash) and perform threat intelligence lookups

- Ensure timely
escalation to L3/IR teams for critical incidents (P1/P2)

- Improve and
tune SIEM use cases and detection rules to reduce false positives

- Maintain
detailed incident documentation, timelines, and reporting

- Support
threat hunting activities using SIEM and EDR tools

​

Required
Qualifications

- 3 to 6 years
of experience in SOC / Cyber Security Operations / Incident Response

- Bachelor’s
degree in Cybersecurity, Computer Science, IT, or related field

- Strong
hands-on experience with SIEM platforms (Sentinel, Splunk, QRadar, ArcSight)

- Experience
with EDR/XDR tools (Microsoft Defender, CrowdStrike, SentinelOne)

- Practical
knowledge of cloud security monitoring (Azure, AWS, GCP)

- Experience in
Netskope DLP and Database Activity Monitoring alert investigations

- Understanding
of email security solutions and phishing/BEC analysis

- Relevant
certifications: CySA+, CCSP, CEH, GCIA, GCIH, SC-200, Splunk Certified

Core
Competencies

- Robust
knowledge of MITRE ATT&CK; framework and attack lifecycle mapping

- Ability to
correlate events across endpoint, network, cloud, and database layers

- Proficiency
in SIEM query languages (KQL, etc.)

- Solid
understanding of network protocols, authentication mechanisms, and log analysis

- Experience in
incident handling, root cause analysis, and attack chain reconstruction

- Strong
analytical and problem-solving skills with attention to detail

- Ability to
work independently and mentor L1 analysts

- Effective
communication skills for technical and non-technical stakeholders

- Ability to work in a
24x7 rotational shift environment

📌 Security Analyst (Serilingampalle (M))
🏢 Leading
📍 Serilingampalle (M)