The Senior SOC Analyst (L2) is responsible for advanced threat detection, investigation and incident response within a 24x7 SOC environment leveraging CrowdStrike Falcon EDR and enterprise SIEM platforms.

In line with the organization chart, this role handles incidents escalated from the Tier I team, provides Tier II threat hunting support, delivers engineering support for detection tuning and use-case development, and produces the monthly threat report.

Incident Management

Escalated Incident Investigation & Validation

- Investigate and validate all alerts and incidents escalated by the Tier I team
- Perform deep endpoint analysis in CrowdStrike Falcon (detections, process trees, RTR)

Incident Response & Containment (P1/P2)
- Execute containment for high-severity incidents – host isolation, IOC blocking, RTR remediation
- Lead technical discussion on incident bridge calls and coordinate with customer and internal teams

Root Cause Analysis (RCA)

- Conduct RCA for P1/P2 and recurring incidents
- Recommend remediation and preventive controls

Proactive Threat Hunting

- Run hypothesis-driven hunts aligned with MITRE ATT&CK;, using Falcon and SIEM data
- Hunt for phishing and lateral-movement activity using current threat intelligence
- Perform retro-hunts for newly published IOCs / TTPs across customer environments

SIEM & EDR Detection Engineering
- Tune SIEM correlation rules and Falcon detection / prevention policies
- Develop and test new use cases; manage IOC lists and exclusions in Falcon
- Validate log-source onboarding and health; raise gaps with the engineering team




- Maintain SOC playbooks and runbooks for Tier I and Tier II

Monthly Threat Report & Documentation
- Compile the monthly threat report – incident statistics, trends, notable incidents, hunt results, threat landscape and recommendations
- Prepare detailed incident reports and executive summaries

Qualitifications

- 4–8 years in SOC / Managed Security workplace
- Minimum 2+ years in L2 incident handling
- Experience in 24x7 SOC operations
- Strong analytical, documentation, and communication skills

Desired Knowledge, Skills

- CEH | Security+ | CySA+ | GCIH | CrowdStrike Certification
- Strong knowledge of windows operating system-based analysis like process tree, Event ID’s, PowerShell logging.
- Hands-on CrowdStrike Falcon experience / Certifications like CrowdStrike CCFR (Responder) or CCFH (Hunter) is preferred.
- An understanding of a wide array of server grade applications such as: DBMS, Exchange, DNS, SMTP, IIS, Apache, SharePoint, Active Directory, Identity Management, Patch Management, LDAP, SQL, and others
- Experience in Hypothesis-driven hunting mapped to MITRE-ATTACK framework.
- Exposure to SOAR playbook, writing & tuning correlation rules

Competencies:

- Interpersonal relationship
- Problem solving and critical analysis
- Achievement orientation
- Time management
- Team collaboration
- Process quality orientation
- Customer orientation
- Documentation skills
- Continuous learning and improvement

Interaction (Internal and External)

- Internal SOC and Security Operations Team
- Internal Leadership and business stakeholders

📌 Enterprise Senior Analyst-Cyber security (Hyderabad)
🏢 Driveit Technologies
📍 Hyderabad