Security Analyst - L2

Role
Overview

The SOC L2
Analyst is responsible for in-depth security investigation, incident analysis,
and response coordination across enterprise environments. This role focuses on
correlating multi-domain telemetry (SIEM, EDR/XDR, Cloud, DLP, DAM, Email
Security) to determine root cause, assess impact, and recommend containment
actions. The analyst acts as a technical escalation point for L1 and
contributes to improving detection use cases and SOC maturity.

Key
Responsibilities

• Perform
  deep-dive investigations on alerts from across SIEM, EDR/XDR, Cloud, DLP, DAM,
  and Email Security tools
  
• Correlate
  logs and telemetry to reconstruct attack timelines and identify root cause
  
• Investigate
  advanced threats such as lateral movement, privilege escalation, account
  compromise, and malware activity
  
• Conduct
  endpoint analysis (process injection, persistence mechanisms, suspicious
  binaries, command-line artifacts)
  
• Analyze cloud
  security incidents (Azure/AWS) including IAM misuse, impossible travel, token
  abuse, and misconfigurations
  
• Perform
  advanced phishing and BEC investigations, including header analysis, URL
  detonation, and payload inspection
  
• Investigate
  DLP (Netskope) alerts for potential data exfiltration, policy violations, and
  insider threats
  
• Analyze data
  movement patterns across endpoints, email, and cloud storage
  
• Tune and
  validate DLP policies to reduce false positives and improve detection accuracy
  
• Investigate
  DAM alerts for unauthorized database access, privilege misuse, abnormal query
  patterns, and potential SQL injection attempts
  
• Correlate
  database activity with user identity and endpoint behavior to detect malicious
  intent
  
• Lead incident
  investigation and provide containment/remediation recommendations
  
• Create and
  enrich IOCs (IP, domain, hash) and perform threat intelligence lookups
  
• Ensure timely
  escalation to L3/IR teams for critical incidents (P1/P2)
  
• Improve and
  tune SIEM use cases and detection rules to reduce false positives
  
• Maintain
  detailed incident documentation, timelines, and reporting
  
• Support
  threat hunting activities using SIEM and EDR tools
  

Required
Qualifications

• 3 to 6 years
  of experience in SOC / Cyber Security Operations / Incident Response
  
• Bachelor’s
  degree in Cybersecurity, Computer Science, IT, or related field
  
• Strong
  hands-on experience with SIEM platforms (Sentinel, Splunk, QRadar, ArcSight)
  
• Experience
  with EDR/XDR tools (Microsoft Defender, CrowdStrike, SentinelOne)
  
• Practical
  knowledge of cloud security monitoring (Azure, AWS, GCP)
  
• Experience in
  Netskope DLP and Database Activity Monitoring alert investigations
  
• Understanding
  of email security solutions and phishing/BEC analysis
  
• Relevant
  certifications: CySA+, CCSP, CEH, GCIA, GCIH, SC-200, Splunk Certified
  

Core
Competencies

• Strong
  knowledge of MITRE ATT&CK framework and attack lifecycle mapping
  
• Ability to
  correlate events across endpoint, network, cloud, and database layers
  
• Proficiency
  in SIEM query languages (KQL, etc.)
  
• Solid
  understanding of network protocols, authentication mechanisms, and log analysis
  
• Experience in
  incident handling, root cause analysis, and attack chain reconstruction
  
• Strong
  analytical and problem-solving skills with attention to detail
  
• Ability to
  work independently and mentor L1 analysts
  
• Effective
  communication skills for technical and non-technical stakeholders
  
• Ability to work in a
  24x7 rotational shift environment