L2 SOC Analyst
- CyberShelter
- 2 - 5 years
- Kochi
- 12 days ago
- Email to a friend
- Report this job
Job Description
Investigate, hunt, and lead escalated incident response using advanced threat detection from SIEM, EDR, NDR platforms. Develop and manage custom detection use cases aligned to threat frameworks and customer environments.
Key Responsibilities:
- Monitoring, Investigation & Triage
- Triage and correlate alerts from SIEM (QRadar/Sentinel), EDR, and NDR
- Identify lateral movement, C2 activity, and data exfiltration
- Lead incident investigations and initiate containment measures
- Threat Hunting & Detection Engineering
- Proactive hunting using logs, flow data, and behavior analytics
- Apply MITRE ATT&CK for hypothesis-driven hunts
- Develop, test, and optimize custom detection rules
- Maintain a backlog aligned with emerging threats
Tool Proficiency
- SIEM: Advanced KQL/AQL queries, rule tuning, alert optimization
- EDR: Defender for Endpoint binary/process analysis, endpoint containment
- NDR: Darktrace/LinkShadow behavioral baselining, detection logic
- SOAR: Sentinel Playbooks / Cortex XSOAR for automated workflows
- Cloud Security: Azure AD alerts, MCAS, Defender for Cloud, M365 Defender
Threat Intelligence Integration
- IOC/TTP enrichment
- Threat intel feed integration
- Contextual alert correlation
Reporting & RCA
- Draft technical incident reports and RCAs
- Executive-level summaries for major incidents
Cloud Security (Optional):
- Investigate alerts like impossible travel, app consent abuse
- Respond to cloud-native security incidents using Defender for Cloud, MCAS
- Create advanced SOAR workflows and playbook
Tool Familiarity
- QRadar
- Microsoft Sentinel
- Microsoft Defender for Endpoint
- LinkShadow or Darktrace
- EOP/Exchange protection
- Antivirus platforms
- Defender for Identity / Defender for Cloud
- Advanced SOAR workflows (Sentinel playbooks / Cortex XSOAR)
- Network forensic tools like Wireshark / Zeek
Certifications (Preferred):
- GCIH / GCIA / CEH
- Microsoft SC-200 / SC-100
- QRadar Admin or equivalent
Shift Readiness:
24x7 rotational shifts, including on-call support for escalations and major incidents
Soft Skills:
- Strong analytical and documentation skills
- Proactive communicator
- Independent problem-solver and critical thinker
Job Classification
Industry: IT Services & ConsultingFunctional Area / Department: IT & Information SecurityRole Category: IT SecurityRole: Security Engineer / AnalystEmployement Type: Full timeContact Details:
Company: CyberShelterLocation(s): Kochi
Keyskills: SOC Operations Cloud Security Defender for Identity Defender for Endpoint KQL Detection Engineering SOAR Threat Intel Incident Response MITRE ATT&CK Threat Hunting Microsoft Sentinel SIEM Use Case Development Darktrace QRadar Cortex XSOAR LinkShadow
Similar positions
CyberShelter
Founded by Cybersecurity stalwarts and passionate investors, CyberShelter (CS) is here to make a difference in how organisations protect their valuable assets. In an industry where practical and cost-effective solutions are rare, CS brings innovative approaches and robust cybersecurity experience to...
Job Listings
We are in open beta version of website, please let us know if any issues, at: info(at)indigojobs.in