SOC Analyst L2

SOC Analyst L2/RE is an operational role, focusing on ticket quality and security incident deeper investigation and will be responsible to handle the escalated incidents from Level 1 team within SLA.

Responsibilities:

. SOC Analyst L2 would work closely with SOC L1 team, L3 team & customer and responsible for performing deeper analysis and need to interact with client in daily calls and need to take the responsibility of handling the True Positive incidents on time.

. Handle escalated incidents and coordinate with client when required.

. Work closely with Client Duty Officers on any ad-hoc operational requests.

. Collaborate with the Exabeam, Splunk, and Log Source teams to resolve issues as needed.

. Take appropriate action on IOCs received from client when required.

. Fine-tune and create new detection rules based on client requests.

o Create and manage the Incident handling playbook, process runbooks and ad-hoc documents whenever needed

o Recommend finetuning for client with logic and threshold, and possibly the query as well for the SIEM

o Recommend new use cases with logic and threshold, and possibly the query as well for the SIEM

. Provide data from Splunk/Exabeam during client audit activities.

. Share monthly data to client for internal IMM meetings.

. Share top user-reported malicious emails from Abnormal Security for reward and recognition programs.

. Prepare RCA report when required

. Share knowledge to other analysts in their role and responsibilities

. Provide knowledge transfer to L1 such as advance hunting techniques, guides, cheat sheets etc

• Minimum 5 Years of experience in Security Operations
• Security event monitoring, alert triage, and thorough incident investigation.
• Research and understand log sources for effective security monitoring.
• Isolate issues, respond to incidents, and mitigate threats swiftly.
• Adjust SIEM rules for better alert and incident specifications.
• Optimize SIEM capabilities, aid in audit/logging, and generate timely reports.
• Develop and maintain security operation standards, procedures, and playbooks.

SOC, SIEM Platforms, Splunk, Exabeam, SOAR platform, Google SecOps, Log Source, Security Operations