Cybersecurity SOC Analyst (L2)

The SOC L2 Analyst is responsible for advanced monitoring, investigation and response to cybersecurity incidents. This role serves as the escalation point for L1 analysts and performs in-depth analysis to ensure timely containment and remediation of threats.

Responsibilities:

Monitor and investigate security alerts escalated from L1 analysts

Perform detailed analysis using SIEM, EDR and related tools

Lead incident response activities, including containment and recovery

Conduct threat hunting based on intelligence and observed patterns

Analyze malware, phishing attempts, and suspicious behaviour

Correlate events across multiple sources to identify threats

Document incidents and response actions clearly

Provide guidance and mentoring to L1 analysts

Fine-tune detection rules to improve alert quality

Work closely with internal teams for incident resolution

Technical Skills & Requirements:

Experience with SIEM tools (e.g. Splunk, netwitness, Sentinel)

Familiarity with EDR platforms (e.g. Carbonblack)

Strong understanding of network protocols and log analysis

Knowledge of MITRE ATT&CK framework

Experience in incident response processes

Basic scripting (Python, PowerShell, or Bash) is preferred

Understanding of security controls such as firewalls, IDS/IPS, and VPNs etc.

Experience & Qualifications:

3–5 years of SOC or cybersecurity operations experience

Relevant qualification in Cybersecurity, IT, or equivalent

Certifications such as CEH, CySA+, GCIH, or Security+ are advantageous

Soft Skills:

Strong analytical and problem-solving skills

Ability to work in a fast-paced SOC environment

Good communication and documentation capability

Team player with mentoring ability