L2 SOC Analyst

Job Description

Job Title: SOC Analyst Level 2 (Cyber Security Operations)

Department: Cyber Security / Security Operations Centre (SOC)

Reports To: SOC Manager / SOC Team Lead

Job Location: NIBM Pune, India

Opportunity: Full-Time

Experience: minimum 4 years.

Compensation: As per the market standards

The SOC Analyst Level 2 is responsible for advanced monitoring, investigation, and response to security incidents within the organization's Security Operations Centre. This role acts as an escalation point for Level 1 analysts, performs deep-dive analysis of alerts, conducts threat hunting activities, and ensures timely remediation of security incidents. The SOC Analyst L2 also contributes to improving security monitoring capabilities, enhancing detection rules, and mentoring junior analysts. Candidates with prior hands-on experience in system administration or network administration are highly preferred, as this role requires strong understanding of enterprise IT infrastructure and network environments.

Responsibilities

Security Monitoring & Alert Investigation

• Monitor and analyse security alerts generated by SIEM, EDR, IDS/IPS, firewalls, and other security tools.
• Investigate escalated alerts from SOC Level 1 analysts.
• Perform deep-dive analysis to determine true positives, false positives, and potential threats.
• Correlate events across multiple log sources including servers, endpoints, applications, network devices, and cloud platforms.
  
  

Incident Response

• Lead investigation and response for Low to high severity security incidents.
• Perform incident triage, root cause analysis, and impact assessment.
• Coordinate containment, eradication, and recovery actions.
• Escalate high-risk incidents to SOC Level 3 or Incident Response teams when required.
• Ensure incidents are documented thoroughly in the incident management system.
  
  

SIEM & Detection Engineering Support

• Assist in tuning SIEM correlation rules and alerts.
• Improve detection use cases and reduce false positives.
• Develop or recommend new detection rules based on emerging threat patterns
  
  

Internal Responsibilities

• Monitor and analyze security logs and alerts using SIEM tools; escalate and assist in incident response as needed.
• Maintain and improve internal cybersecurity tools, scripts, and dashboards for threat detection and reporting.
• Collaborate with the Security Administrator to ensure consistent execution of security protocols and procedures.
• Assist in the deployment and configuration of security technologies such as firewalls, endpoint protection, and email filtering.
• Support internal training efforts to ensure staff are aware of current cybersecurity threats and mitigation strategies.
  
  

Collaboration & Escalation

• Act as a technical escalation point for SOC Level 1 analysts.
• Work closely with IT infrastructure, network, and cloud teams for incident resolution.
• Coordinate with vulnerability management and threat intelligence teams.
  
  

Security Tool Management

• Support implementation, configuration, and tuning of SOC security tools including:
• SIEM platforms
• Endpoint Detection and Response (EDR/XDR)
• IDS/IPS
• SOAR platforms
• Maintain detection rules and automation playbooks.
  
  

Reporting & Documentation

• Maintain detailed documentation of investigations and incidents.
• Prepare incident reports and security analysis documentation.
• Contribute to SOC operational metrics and reporting.
  
  

Experience

• 35 years of experience in Security Operations Centre (SOC) or Cybersecurity operations.
• Experience in security incident monitoring, analysis, and response.
• Prior experience as a System Administrator or Network Administrator is highly preferred.
• Experience working in enterprise IT environments.
  
  

Security Technologies

• SIEM platforms (Knowledge and at least one year of experience in Microsoft Sentinel is a must)
• EDR/XDR tools (CrowdStrike, Microsoft Defender)
• IDS/IPS solutions
• Firewall technologies
  
  

Preferred Certifications

• One or more of the following certifications is preferred:
• CompTIA Security+
• Certified Ethical Hacker (CEH)
• GIAC Certified Incident Handler (GCIH)
• Certified SOC Analyst (CSA)
  
  

Soft Skills

• Strong analytical and investigative skills
• Excellent troubleshooting ability
• Effective communication and reporting skills
• Ability to mentor junior analysts
• Ability to work in fast-paced SOC environments
• Strong attention to detail