Job Position: SOC Analyst L2

We are looking for a SOC L2 Analyst to own escalated and complex security investigations and support reliable daily SOC operations. The analyst will correlate evidence, determine incident scope, execute or coordinate approved response actions, and maintain cases through resolution or escalation. The role also improves detection quality and guides L1 analysts under the SOC Manager or SOC Lead.

Role: Individual contributor in Security Operations

Reports to: SOC Manager or SOC Lead

Experience: Typically 3-6 years in SOC or security operations

Key responsibilities

- Daily queue ownership. Review assigned incidents and L1 escalations, correlate related alerts, prioritize by severity and business impact, and manage aged cases against agreed response and update targets.
- Incident investigation. Analyze SIEM alien Vault and Data Dog at present, endpoint, identity, email and network evidence to establish timelines, affected assets, likely entry points and attack progression. Record confirmed findings, hypotheses and evidence gaps.
- Response and closure. Execute or coordinate authorized containment, including endpoint isolation, account or session controls and malicious-email removal. Preserve relevant evidence, track remediation with system owners and verify closure criteria.
- Escalation and communication. Promptly escalate high-impact, unclear or complex incidents to SOC leadership, L3 or response specialists. Provide updates covering evidence, impact, actions taken, decisions required and next steps.
- SIEM and EDR operations. Write and adapt investigation queries; review process trees, command lines and authentication patterns. Identify missing logs, failed connectors or unhealthy sensors and coordinate correction with responsible teams.
- Detection improvement and hunting. Investigate recurring false positives, propose or implement approved rule changes, and validate detection coverage. Conduct focused hunts using relevant intelligence and observed attacker behavior.
- Documentation and handovers.



Maintain incident records with evidence references, queries, timestamps, approvals and actions. Hand over open cases with named owners, pending tasks, deadlines and escalation triggers.
- Operational improvement and L1 guidance. Improve playbooks and investigation checklists, share incident lessons and support L1 analysts. Follow evidence-handling, access-control and customer confidentiality requirements.

Required experience and skills:

- Demonstrated ownership of security investigations beyond initial alert triage, including incident scoping, response coordination and evidence-based closure.
- Practical experience with at least one enterprise SIEM, such as Microsoft Sentinel, Splunk or IBM QRadar, and one EDR platform, such as Microsoft Defender, CrowdStrike or SentinelOne.
- Ability to write and adapt queries in the relevant platform language, such as KQL, SPL or AQL, and correlate results across log sources.
- Ability to interpret Windows and Linux system logs, authentication records, and relevant email, DNS, proxy and firewall telemetry; working knowledge of networking and enterprise identity.
- Experience investigating phishing, password spraying, account compromise, malware, suspicious scripts, privilege misuse and indicators of lateral movement.
- Sound judgment on severity, business impact, evidence preservation, response authority and escalation; ability to distinguish confirmed findings from assumptions.
- Explicit incident documentation and stakeholder communication, with disciplined ticket management, follow-up and shift handovers.

Preferred skills

- Experience in an MSSP or customer-facing SOC, including communication with customer technical teams.
- Cloud investigations involving AWS or Azure identity, audit and security logs.
- Familiarity with MITRE ATT&CK, structured threat hunting, SOAR workflows, or Python and PowerShell scripting.
- Relevant security or platform certifications that support demonstrated operational skills.

Pay: ₹900,000.00 - ₹1,200,000.00 per year

Benefits:

- Health insurance
- Provident Fund

Work Location: In person

📌 SOC Analyst (Hyderabad)
🏢 Entersoft Informations
📍 Hyderabad