Job Title : SOC Analyst – L2

Experience : 3+ to 5+ Years of Experience in Security Operations

Location : Mumbai : BKC (Bandra Kurla Complex - Work from Office)

Job Summary :

We are looking for an experienced and highly analytical SOC Analyst L2 to join our Security Operations Center (SOC) / Cyber Defense Center (CDC). The SOC Analyst L2 will serve as an advanced incident responder responsible for investigating complex security incidents, conducting advanced threat hunting activities, developing detection use cases, and supporting security monitoring platforms such as IBM QRadar and SentinelOne EDR/XDR.

The candidate should possess deep expertise in incident investigation, malware analysis, threat intelligence, MITRE ATT&CK; mapping, SIEM content development, and security operations processes. The role requires close collaboration with IT, Cloud, Engineering, and Security teams to enhance the organization's overall detection and response capabilities.

Key Responsibilities

Security Monitoring & Incident Response

- Perform in-depth investigation and analysis of security alerts escalated from L1 analysts.
- Lead the triage, containment, eradication, and recovery activities for cybersecurity incidents.
- Handle high-severity and critical incidents, including malware outbreaks, ransomware attacks, account compromises, insider threats, and advanced persistent threats (APTs).
- Conduct root cause analysis (RCA) and provide actionable remediation recommendations.
- Act as an escalation point for complex security investigations.

Threat Hunting & Threat Intelligence

- Conduct proactive threat hunting using endpoint, network, cloud, and identity telemetry.
- Leverage threat intelligence feeds, Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and TTPs to identify emerging threats.
- Map attack techniques to the MITRE ATT&CK; framework and identify gaps in detection coverage.
- Develop advanced hunting queries and investigative methodologies to uncover hidden threats.
- Monitor threat actor trends and emerging attack campaigns relevant to the organization's environment.

Detection Engineering & Use Case Development

- Design, develop, and optimize SIEM correlation rules and security analytics.
- Create and enhance custom dashboards, workbooks, reports, and visualizations.
- Perform alert tuning and reduce false positives while improving detection effectiveness.
- Develop security use cases aligned to threat intelligence and MITRE ATT&CK; techniques.




- Collaborate with engineering teams to improve logging and visibility across enterprise environments.

SIEM & EDR Administration

- Manage and optimize IBM QRadar SIEM for monitoring, correlation, and investigations.
- Perform advanced investigations using SentinelOne EDR/XDR.
- Support onboarding and parsing new log sources.
- Develop custom integrations for unsupported data sources.
- Ensure data quality, normalization, and log source health across monitoring platforms.

Malware, Phishing & Forensics Analysis

- Analyze malware samples, suspicious files, and malicious URLs.
- Investigate phishing incidents utilizing email security tools and threat intelligence.
- Conduct endpoint investigations and digital forensic triage activities.
- Review attack chains and identify attacker techniques and persistence mechanisms.
- Document findings with detailed forensic timelines and recommendations.

Incident Management & Process Improvement

- Develop and maintain SOC playbooks, runbooks, and standard operating procedures.
- Participate in incident response tabletop exercises and simulation activities.
- Identify automation opportunities and support SOAR implementation initiatives.
- Review security incidents and recommend process improvements.
- Contribute to SOC maturity and continuous improvement programs.

Collaboration & Mentorship

- Mentor and guide L1 analysts during investigations and incident triage.
- Review and validate incident reports generated by junior team members.
- Collaborate with cloud, infrastructure, identity, and network teams for remediation activities.
- Provide technical expertise during internal and customer-facing security discussions.
- Participate in executive and customer incident briefings as required.

Experience & Technical Skills

- Minimum 3+ to 5+ years of experience in a SOC, Incident Response, Threat Detection, or Cyber Defense role.
- Minimum 2+ years of hands-on experience with IBM QRadar SIEM.
- Solid hands-on experience with SentinelOne EDR/XDR.
- Experience leading investigations of complex and critical security incidents.
- Proven experience in threat hunting and incident response activities.





Security Operations

- Advanced incident response and investigation skills.
- Threat detection and threat hunting expertise.
- Malware analysis and phishing investigation experience.
- Security monitoring and event correlation.
- Digital forensics and endpoint investigations.

Frameworks & Methodologies

- MITRE ATT&CK; Framework.
- Cyber Kill Chain.
- NIST Incident Response Framework.
- Threat Intelligence Lifecycle.
- Security Operations Best Practices.

SIEM & EDR

- IBM QRadar administration and content management.
- Correlation rule creation and optimization.
- Dashboard and report development.
- SentinelOne EDR/XDR investigation capabilities.
- Alert tuning and use-case engineering.

Networking & Security Fundamentals

- TCP/IP, DNS, HTTP, HTTPS, SMTP.
- IDS/IPS, Firewalls, Proxy Technologies.
- Network traffic analysis.
- Active Directory and Identity Management.
- Cloud security monitoring.

Scripting & Automation

- Security Automation and SOAR platforms

Preferred Qualifications

- Experience in Managed Security Services (MSSP) environments.
- Experience with threat intelligence platforms.
- Experience building custom parsers, DSMs, and integrations.
- Experience with vulnerability management and attack surface monitoring.
- Experience working in customer-facing consulting engagements.
- Knowledge of Zero Trust Architecture.
- Experience performing purple team, threat emulation, or adversary simulation exercises.

Preferred Certifications The following certifications are highly desirable:

Industry Certifications

- CompTIA CySA+
- CompTIA Security+
- EC-Council Certified SOC Analyst (CSA)
- EC-Council Certified Incident Handler (ECIH)
- GIAC Certified Incident Handler (GCIH)
- GIAC Certified Intrusion Analyst (GCIA)
- Certified Ethical Hacker (CEH)
- CISSP (Associate or Certified)
- IBM QRadar SIEM Certifications
- SentinelOne Certifications
- Splunk Enterprise Security Certifications

A successful L2 SOC Analyst will:
- Independently investigate and resolve complex security incidents.
- Identify advanced threats through proactive threat hunting.
- Develop high-quality detection content and SIEM use cases.
- Reduce alert fatigue through effective tuning and optimization.
- Improve overall security visibility and detection coverage.
- Mentor junior analysts and contribute to SOC operational maturity.
- Drive continuous improvements in security monitoring, incident response, and threat intelligence integration.

📌 Security Operations Center Analyst (Mumbai)
🏢 Cloud4C Services
📍 Mumbai