Role Overview The L3 Threat Analyst leads complex incident response and advanced threat investigations, owning incidents end-to-end while guiding L1/L2 analysts. This role combines deep technical expertise, adversary understanding, and detection engineering to strengthen the organization’s overall security posture.

Key Responsibilities

Advanced Incident Response Leadership

- Lead high-severity and complex incidents (multi-stage attacks, APTs, lateral movement, data exfiltration)
- Own end-to-end response: detection → investigation → containment → eradication → recovery
- Act as the technical decision-maker during active incidents

Deep Threat Investigation

- Perform advanced analysis across:
- Endpoint telemetry, memory artifacts, disk forensics
- Network traffic (PCAP, NDR)
- Identity and cloud logs
- Reconstruct full attack chains and identify root cause + blast radius
- Handle fileless malware, living-off-the-land (LotL), and stealthy persistence techniques

Threat Hunting & Adversary Emulation

- Design and lead proactive threat hunting campaigns
- Simulate attacker techniques (red/purple mindset) to validate detection coverage
- Identify gaps and convert them into high-fidelity detections

Detection Engineering

- Design, build, and optimize advanced detection logic
- Develop detections across:
- SIEM (correlation rules, anomaly detection)
- EDR/NDR analytics
- Ensure coverage across the MITRE ATT&CK; framework
- Mentor L1/L2 on detection quality and tuning

Forensics & Malware Analysis

- Conduct host and network forensics
- Perform static and basic dynamic malware analysis
- Extract IOCs, behaviors, and detection patterns

Automation & SOC Engineering Collaboration

- Define and drive automation strategy (SOAR, pipelines)




- Collaborate with engineering teams to:
- Improve telemetry pipelines
- Optimize data ingestion and correlation
- Scale detection systems for high EPS environments

Incident Command & Stakeholder Management

- Act as Incident Commander for critical incidents
- Provide clear, structured communication to leadership
- Lead post-incident reviews and drive corrective actions

SOC Maturity & Strategy

- Define and improve:
- IR playbooks
- Detection coverage roadmap
- SOC metrics (MTTD, MTTR, detection fidelity)
- Continuously enhance SOC capabilities and resilience

Required Skills & Qualifications

- 5+ years of experience in Incident Response / Threat Hunting / SOC Engineering
- Strong expertise in:
- Advanced attack techniques (APT, lateral movement, persistence)
- MITRE ATT&CK; mapping and adversary behavior analysis
- Windows & Linux internals
- Hands-on experience with:
- SIEM (Splunk, ELK, Sentinel, etc.)
- EDR/NDR platforms
- Log correlation in large-scale distributed systems
- Deep knowledge of:
- Networking (packet-level understanding, DNS abuse, C2 patterns)
- Identity attacks (Kerberos, AD abuse, credential theft)
- Strong scripting/programming skills (Python, PowerShell, Bash)

Good to Have

- Experience in high-throughput environments (100K+ EPS, data lakes)
- Detection engineering frameworks (Sigma, YARA, KQL, SPL)
- Cloud security and container environments
- Reverse engineering (intermediate level)
- Experience in SOAR and automation design

Key Traits

- Thinks like an attacker, acts like a defender
- Solid ownership and decision-making under pressure
- Systems-level thinking (not just alerts, but pipelines and architecture)
- Mentorship mindset for L1/L2 analysts

Required Skills threat MITRE ATT&CK;

📌 Threat Analyst/Incident Response Lead (Kanpur)
🏢 C3iHub, IIT Kanpur
📍 Kanpur