Role Overview The L3 Threat Analyst leads complex incident response and advanced threat investigations, owning incidents end-to-end while guiding L1/L2 analysts. This role combines deep technical expertise, adversary understanding, and detection engineering to strengthen the organization’s overall security posture.

Key Responsibilities
Advanced Incident Response Leadership
• Lead high-severity and complex incidents (multi-stage attacks, APTs, lateral movement, data exfiltration)
• Own end-to-end response: detection → investigation → containment → eradication → recovery
• Act as the technical decision-maker during active incidents Deep Threat Investigation
• Perform advanced analysis across:
• Endpoint telemetry, memory artifacts, disk forensics
• Network traffic (PCAP, NDR)
• Identity and cloud logs
• Reconstruct full attack chains and identify root cause + blast radius
• Handle fileless malware, living-off-the-land (LotL), and stealthy persistence techniques Threat Hunting & Adversary Emulation
• Design and lead proactive threat hunting campaigns
• Simulate attacker techniques (red/purple mindset) to validate detection coverage
• Identify gaps and convert them into high-fidelity detections Detection Engineering
• Design, build, and optimize advanced detection logic
• Develop detections across:
• SIEM (correlation rules, anomaly detection)
• EDR/NDR analytics
• Ensure coverage across the MITRE ATT&CK; framework
• Mentor L1/L2 on detection quality and tuning Forensics & Malware Analysis
• Conduct host and network forensics
• Perform static and basic dynamic malware analysis
• Extract IOCs, behaviors, and detection patterns Automation & SOC Engineering Collaboration
• Define and drive automation strategy (SOAR, pipelines)




• Collaborate with engineering teams to:
• Improve telemetry pipelines
• Optimize data ingestion and correlation
• Scale detection systems for high EPS environments Incident Command & Stakeholder Management
• Act as Incident Commander for critical incidents
• Provide clear, structured communication to leadership
• Lead post-incident reviews and drive corrective actions SOC Maturity & Strategy
• Define and improve:
• IR playbooks
• Detection coverage roadmap
• SOC metrics (MTTD, MTTR, detection fidelity)
• Continuously enhance SOC capabilities and resilience Required Skills & Qualifications
• 5+ years of experience in Incident Response / Threat Hunting / SOC Engineering
• Strong expertise in:
• Advanced attack techniques (APT, lateral movement, persistence)
• MITRE ATT&CK; mapping and adversary behavior analysis
• Windows & Linux internals
• Hands-on experience with:
• SIEM (Splunk, ELK, Sentinel, etc.)
• EDR/NDR platforms
• Log correlation in large-scale distributed systems
• Deep knowledge of:
• Networking (packet-level understanding, DNS abuse, C2 patterns)
• Identity attacks (Kerberos, AD abuse, credential theft)
• Strong scripting/programming skills (Python, PowerShell, Bash) Good to Have
• Experience in high-throughput environments (100K+ EPS, data lakes)
• Detection engineering frameworks (Sigma, YARA, KQL, SPL)
• Cloud security and container environments
• Reverse engineering (intermediate level)
• Experience in SOAR and automation design Key Traits
• Thinks like an attacker, acts like a defender
• Robust ownership and decision-making under pressure
• Systems-level thinking (not just alerts, but pipelines and architecture)
• Mentorship mindset for L1/L2 analysts Required Skills threat MITRE ATT&CK;

📌 Threat Analyst/Incident Response Lead (Kanpur)
🏢 C3iHub, IIT Kanpur
📍 Kanpur