Purpose

Perform detailed security incident investigation, analysis, containment, and response.

Provide

Level 2 support for escalated alerts and incidents, conduct threat hunting, and improve SOC detection and response capabilities.

Area of Responsibility

- Advanced security incident investigation.

- Incident response and containment.

- SIEM/EDR investigation and correlation.

- Threat hunting and proactive analysis.

- Detection and use-case improvement.

- L1 escalation support and mentoring.

- Root-cause analysis.

- SOC process improvement.

Tasks

- Investigate security incidents escalated by L1 analysts.

- Correlate events across SIEM, EDR/XDR, firewall, identity, cloud, email, and network security platforms.

- Perform detailed investigation of malware, phishing, credential compromise, suspicious authentication, lateral movement, and endpoint/network attacks.

- Identify attack vectors, affected assets, indicators of compromise, and potential business impact.

- Recommend or execute appropriate containment and remediation actions according to approved procedures.

- Perform threat hunting based on IOCs, TTPs, intelligence, and anomalous behavior.

- Map observed attacker behavior against MITRE ATT&CK; techniques.

- Perform root-cause analysis and document incident findings.

- Support tuning of SIEM correlation rules and detection use cases to reduce false positives.





- Develop and improve SOC investigation playbooks.

- Mentor L1 analysts and perform quality reviews of escalated incidents.

- Contribute to incident reports, dashboards, KPIs, and customer/service review meetings.

Knowledge

- Strong understanding of SOC monitoring and incident response processes.

- Positive understanding of Windows, Linux, Active Directory, Entra ID, cloud, and network security.

- Knowledge of common attack techniques, malware behavior, credential attacks, persistence, privilege escalation, and lateral movement.

- Strong understanding of SIEM correlation and log analysis.

- Working knowledge of EDR/XDR investigation.

- Knowledge of MITRE ATT&CK;, Cyber Kill Chain, and incident response frameworks.

- Understanding of threat intelligence and threat-hunting methodologies.

Skills

- Hands-on experience with Microsoft Sentinel, Splunk, IBM QRadar, or equivalent SIEM.

- Experience with Microsoft Defender XDR, CrowdStrike, SentinelOne, or equivalent EDR/XDR.

- Advanced log correlation and incident investigation.

- Threat hunting and IOC/TTP analysis.

- SIEM use-case tuning and detection enhancement.

- Basic scripting capability using PowerShell, Python, or KQL/SPL.

- Strong analytical, troubleshooting, and root-cause-analysis skills.

- Ability to mentor L1 analysts and communicate incident findings clearly.

📌 Soc Analyst 2 (Bengaluru)
🏢 Wipro
📍 Bengaluru