Job description
Role & responsibilities
SOC Analyst L2
Security Monitoring & Incident Response
- Execute/lead initial containment, forensics scoping, and stakeholder updates; align with both best industry practice and internal IR playbooks.
- Lead investigations across Defender XDR/MDE and CrowdStrike (process trees, lateral movement, identity signals).
- Use Tanium for rapid endpoint scoping and live response actions (as per policy).
- Analyse Joe Sandbox reports (behaviour trees, network indicators, dropped files); derive IOCs/YARA candidates; coordinate containment.
- Design/maintain Cortex XSOAR playbooks (data enrichment, containment workflows, approvals, notifications); implement guardrails.
Threat Detection & Hunting
- Deep familiarity with Azure AD/Entra ID, Azure Activity/Signin logs, M365 audit logs, as well as AWS and GCP logs.
- Author and tune analytic rules in Sentinel (KQL), Elastic (DSL/EQL/KQL/ESQL), Sigma; reduce false positives; add entity mapping and suppression logic.
- Proactive hunts using ATT&CK-aligned hypotheses (credential theft, persistence, C2); pivot across endpoint, identity, network, and cloud logs.
- Maintain GitLab repos (branching, merge requests, CI checks for detections) and workflows for detection content (code reviews, approvals, CI quality checks).
Expertise:
- Deep knowledge of SIEM, SOAR, and EDR platforms
- Deep knowledge of threat intelligence, and incident response frameworks
- Familiarity with MITRE ATT&CK, NIST, and ISO 27001 standards
- Ability to analyse logs, network traffic, and malware indicators
