We are seeking an experienced and technically proficient L3 SOC Analyst Incident Responder to lead advanced security investigations coordinate incident response activities and enhance the organization s detection and response capabilities This role requires deep hands on expertise in SIEM SOAR EDR and cloud security technologies as well as the ability to collaborate effectively with L1 L2 analysts and customer stakeholders
The L3 Analyst serves as a senior technical authority within the SOC driving complex investigations developing advanced detection use cases refining threat hunting strategies and ensuring alignment with frameworks like MITRE ATT and CK and NIST
Key Responsibilities
Advanced Monitoring and Incident Response
Lead the investigation containment eradication and recovery of complex security incidents following NIST Incident Response framework
Provide end to end incident response management including coordination with internal and external stakeholders
Perform root cause analysis forensics and post incident reporting to prevent recurrence
Guide and support L1 and L2 SOC Analysts in escalated incident analysis and response workflows
SIEM Operations and Engineering
Hands on experience with multiple SIEM platforms such as LogRhythm Securonix Azure Sentinel Splunk and Palo Alto XSIAM
Manage log integration parsing normalization and correlation from diverse data sources endpoints network cloud and applications
Develop and optimize detection use cases based on UEBA insider threats and threat intelligence aligned with MITRE ATT and CK TTPs
Validate quality fine tune correlation rules and reduce false positives across the SOC environment
Threat Hunting and Threat Intelligence
Conduct proactive threat hunting using SIEM EDR IDP and cloud security platforms Azure preferred
Utilize threat intelligence feeds to enhance detection logic and enrich incident analysis
Correlate threat indicators with real time telemetry to identify advanced persistent threats APTs and targeted attacks
SOAR Automation and Process Improvement
Design implement and optimize SOAR playbooks across Splunk SOAR Securonix SOAR and Palo Alto XSOAR
Automate routine SOC workflows to improve incident response efficiency and consistency
Collaborate with engineering and architecture teams to enhance SOC tool integration and response orchestration
Endpoint and Data Security
Perform advanced endpoint analysis using CrowdStrike Falcon and Microsoft Defender for Endpoint MDE
Investigate and remediate Data Loss Prevention DLP incidents and policy violations
Provide technical guidance on endpoint hardening and data protection strategies
Collaboration and Customer Engagement
Act as a senior point of contact for L1 and L2 analysts mentoring reviewing cases and providing technical direction
Drive customer calls understand client specific security challenges and deliver customized solutions
Communicate complex security issues clearly to both technical and non technical stakeholders
Contribute to continuous SOC process improvement reporting and compliance initiatives
Required Skills and Qualifications
Bachelor s degree in computer science Cybersecurity or related field or equivalent hands on experience
8 to 12 years of experience in Security Operations Threat Detection or Incident Response roles
DLP Solutions Email Security Tools and Cloud Security Azure preferred
Robust understanding of MITRE ATT and CK NIST Cybersecurity Framework and incident response lifecycle
Proven experience in building and refining detection use cases particularly UEBA insider threats and threat intelligence based detections
Solid knowledge of network protocols log analysis and digital forensics
Excellent analytical thinking communication and leadership skills
Willingness to work in a 24 7 rotational shift environment
Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.