SOC Analyst- Tier 2 Investigation

• Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
• Perform detailed analysis of security events, logs, network traffic, and endpoint activities to identify malicious behavior.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) to determine the scope and impact of security incidents.
• Perform proactive threat hunting exercises using SIEM, EDR, and threat intelligence platforms.
• Investigate advanced threats, malware infections, phishing attacks, insider threats, and anomalous activities.
• Correlate events from multiple security tools to identify attack patterns and potential breaches.
• Develop and enhance use cases, detection rules, correlation logic, and SOC playbooks.
• Document investigation findings, root cause analysis, and incident reports.
• Collaborate with IT, infrastructure, network, and application teams during incident response activities.
• Support digital forensics activities and evidence collection when required.
• Participate in security incident response drills and continuous improvement initiatives.
• Mentor junior SOC analysts and provide technical guidance on complex investigations.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 5-8 years of experience in Cyber Security Operations Center (SOC) environments.
• Minimum 3+ years of experience performing Tier 2 or advanced security investigations.
• Professional certification:
• CompTIA CySA+ (Cybersecurity Analyst), or
• GIAC Certified Intrusion Analyst (GCIA)
• Strong understanding of:
• Security Incident Response
• Threat Detection and Analysis
• Network Security
• Endpoint Security
• Security Monitoring
• Threat Intelligence
• Experience with enterprise SIEM platforms such as:
• Microsoft Sentinel
• Splunk
• IBM QRadar
• ArcSight
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, Carbon Black, or SentinelOne.