Security Operations Center (SOC) Analyst II

Security Operations Center (SOC) Analyst II

Location

Bangalore, India

Department

Cybersecurity Operations Center (CSOC)

Employment Type

Full-Time

Work Arrangement

Bangalore-based; remote/hybrid options negotiable after onboarding

Role focus

Independently investigate, hunt, improve detections, guide remediation, and mentor junior analysts. Own escalated cases through defensible technical findings.

Job Summary

The Security Operations Center (SOC) Analyst II is a mid-level cybersecurity role responsible for independently managing escalated security investigations, performing threat hunting, improving detection coverage, and developing operational playbooks. The analyst correlates evidence across identity, endpoint, email, network, vulnerability, and cloud telemetry, recommends containment and remediation actions, and communicates defensible findings to technical and business stakeholders. This role also mentors SOC Analyst I team members and helps mature CSOC investigation and detection practices.

Key Responsibilities

• Lead security investigations across SIEM, endpoint, identity, email, vulnerability, network, and cloud security telemetry.
• Reconstruct incident timelines, determine scope, identify affected users and assets, document evidence, and develop evidence-based root cause findings when supported by available telemetry.
• Perform threat hunting and cross-platform correlation to validate suspicious activity, identify related events, and determine whether investigation scope should expand.
• Develop, review, and tune KQL queries, analytic rules, hunting queries, and other detection logic to improve signal quality and coverage.
• Recommend containment and remediation actions based on investigation evidence and validate that corrective actions address the identified security issue.
• Identify detection, logging, telemetry, or control gaps revealed by investigations and recommend practical improvements with clear ownership.
• Develop and maintain SOPs, investigation playbooks, knowledge articles, and repeatable analyst workflows.
• Investigate cloud security events using AWS or hybrid-cloud telemetry and cloud security monitoring/CSPM platforms.
• Support vulnerability analysis by correlating vulnerability data with asset context, exposure, security telemetry, and remediation status.
• Mentor SOC Analyst I team members, review investigation quality, and provide guidance during complex or high impact security events.
• Coordinate with IT, identity, endpoint, cloud, infrastructure, engineering, GRC, and other stakeholders during investigation and remediation activities.
• Produce concise technical findings and executive-ready incident summaries that separate confirmed evidence, analysis, open questions, and recommended next actions.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.
• 3+ years of hands-on experience in a SOC, incident response, threat detection, security engineering, or closely related operational security role.
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender, Sophos or comparable EDR platforms, Tenable or comparable vulnerability platforms, and enterprise security monitoring tools.
• Intermediate to advanced KQL skills for investigation, hunting, correlation, and detection development.
• Strong understanding of Microsoft 365 and identity security, including authentication events, MFA, account activity, session behavior, and suspicious access patterns.
• Experience investigating endpoint activity using process trees, file hashes, command lines, persistence indicators, and network connections.
• Experience with AWS or hybrid-cloud security monitoring and cloud security posture or workload protection concepts.
• Working knowledge of PowerShell or Python for investigation support, data analysis, or security automation.
• Experience documenting incident response findings, developing playbooks, and communicating remediation recommendations.
• Strong technical writing and stakeholder communication skills with the ability to work independently with minimal oversight.

Preferred Skills and Certifications

Microsoft Certified

Security Operations Analyst Associate (SC-200).

• CompTIA CySA+, GIAC Certified Incident Handler (GCIH), Microsoft Cybersecurity Architect Expert, AWS Certified Security - Specialty, or comparable security certification.
• Experience creating or tuning detections in Microsoft Sentinel or comparable SIEM platforms.
• Experience with threat hunting methodologies and mapping observed activity to MITRE ATT&CK techniques when appropriate.
• Experience with ITSM workflows, ticket lifecycle management, and evidence-driven security documentation.
• Experience mentoring junior analysts, performing investigation quality reviews, or helping standardize SOC operating procedures.

Success in This Role

Success is demonstrated through independent investigation quality, defensible findings, effective threat hunting and detection improvement, strong cross-team coordination, and measurable development of junior analysts.