L2/L3 Analyst – SOC / DFIR

Job Summary:

Key Responsibilities:

• Strong hands-on experience in raw log and network traffic analysis, including PCAPs, firewall logs, Windows/Linux Event logs, and security telemetry, to identify and investigate C2 traffic, suspicious communications, scanning activity, data exfiltration/transfer, and protocol- level anomalies.
• Perform Digital Forensics and Incident Response (DFIR) investigations for compromised endpoints, servers, accounts and network infrastructure.
• Conduct onsite client visits for security incident investigations, troubleshooting, and technical assessments, including onsite log collection and capture from firewalls, servers, endpoints, network devices, and other security infrastructure.
• Perform detailed log analysis and event correlation across Windows, Linux, Active Directory, firewall, VPN, DNS, proxy, endpoint and cloud environments.
• Investigate and triage escalated security incidents received from SOC L1 and determine severity, impact, scope and required response.
• Investigate firewall alerts including suspicious inbound/outbound traffic, port scans, malicious IPs, blocked connections, C2 communication and abnormal network activity.
• Perform advanced endpoint investigation using EDR/XDR telemetry, process trees, command lines, file activity, persistence and network connections.
• Conduct vulnerability assessment activities, analyse vulnerability scan results and coordinate remediation with infrastructure/application teams.
• Track critical and high-risk vulnerabilities, validate remediation status and escalate overdue vulnerabilities to appropriate stakeholders.
• Perform proactive threat hunting using SIEM, EDR, firewall, DNS, identity, vulnerability and threat-intelligence data.
• Design and maintain detection use cases mapped to MITRE ATT&CK tactics and techniques and continuously identify detection gaps.
• Lead investigation and response for P2/P3 incidents and provide technical support and escalation handling for P1/Critical incidents.
• Handle client escalations, provide technical analysis, incident updates, remediation recommendations and timely closure as per SLA.
• Participate in client meetings and client visits for security assessments, incident investigations, SOC reviews, technical discussions and security improvement activities.
• Coordinate with client Network, Infrastructure, IAM, Cloud, Application, VAPT and IT teams for incident containment and remediation.
• Conduct root-cause analysis, attack timeline reconstruction, impact assessment and prepare detailed RCA/post-incident reports.
• Develop, maintain and improve incident response playbooks, SOPs, investigation procedures and operational runbooks.
• Support security automation/SOAR activities for alert enrichment, investigation, ticket creation and response actions.
• Mentor L1/L2 analysts, review complex investigations, conduct technical knowledge-sharing sessions and improve SOC operational processes.
• Maintain accurate incident records, vulnerability reports, client escalations, investigation evidence in ticketing tool and contribute to SOC maturity and continuous improvement.
• Monitor, analyze and respond to security alerts across SIEM, EDR/XDR, firewall, IDS/IPS, email, network and cloud security platforms.

Eligibility Criteria:

• 3–6+ years of experience for SOC L2/L3 roles, depending on the organization and role scope.
• Bachelor’s degree in computer science, Information Technology, Cybersecurity, Electronics, or a related technical discipline.
• SIEM/EDR-specific certifications such as Microsoft Security, Splunk, CrowdStrike, Sentinel One, Fortinet or equivalent vendor certifications are an advantage.
• Knowledge of MITRE ATT&CK, NIST Incident Response Framework

. Knowledge of MITRE ATT&CK, NIST Incident Response Framework

Work Environment:

• Willingness to work in a 24x7 rotational shift environment.

Travel Requirements:

• Travel may be required across locations for project execution, monitoring, and team coordination.