{"id":3369468,"url":"https://alion.io/job/alvaria-security-operations-center-soc-analyst-ii","title":"Security Operations Center (SOC) Analyst II","company":{"id":1923389,"name":"Alvaria","domain":"alvaria.com","url":"https://alion.io/company/alvaria","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"ADP","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Sophos","optional":false},{"name":"ITSM","optional":true},{"name":"MITRE ATT&CK","optional":true}],"status":"live","first_seen_at":"2026-10-28T00:23:20Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-11-06T04:39:12Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"Security Operations Center (SOC) Analyst II\nLocation: Bangalore, India\nDepartment: Cybersecurity Operations Center (CSOC)\nEmployment Type: Full-Time\nWork Arrangement: Bangalore-based; remote/hybrid options negotiable after onboarding\nRole focus: Independently investigate, hunt, improve detections, guide remediation, and mentor junior analysts. Own escalated cases through defensible technical findings.\nJob Summary\nThe Security Operations Center (SOC) Analyst II is a mid-level cybersecurity role responsible for independently managing escalated security investigations, performing threat hunting, improving detection coverage, and developing operational playbooks. The analyst correlates evidence across identity, endpoint, email, network, vulnerability, and cloud telemetry, recommends containment and remediation actions, and communicates defensible findings to technical and business stakeholders. This role also mentors SOC Analyst I team members and helps mature CSOC investigation and detection practices.\nKey Responsibilities\nLead security investigations across SIEM, endpoint, identity, email, vulnerability, network, and cloud security telemetry.\nReconstruct incident timelines, determine scope, identify affected users and assets, document evidence, and develop evidence-based root cause findings when supported by available telemetry.\nPerform threat hunting and cross-platform correlation to validate suspicious activity, identify related events, and determine whether investigation scope should expand.\nDevelop, review, and tune KQL queries, analytic rules, hunting queries, and other detection logic to improve signal quality and coverage. • Recommend containment and remediation actions based on investigation evidence and validate that corrective actions address the identified security issue.\nIdentify detection, logging, telemetry, or control gaps revealed by investigations and recommend practical improvements with clear ownership.\nDevelop and maintain SOPs, investigation playbooks, knowledge articles, and repeatable analyst workflows.\nInvestigate cloud security events using AWS or hybrid-cloud telemetry and cloud security monitoring/CSPM platforms.\nSupport vulnerability analysis by correlating vulnerability data with asset context, exposure, security telemetry, and remediation status.\nMentor SOC Analyst I team members, review investigation quality, and provide guidance during complex or high impact security events.\nCoordinate with IT, identity, endpoint, cloud, infrastructure, engineering, GRC, and other stakeholders during investigation and remediation activities. • Produce concise technical findings and executive-ready incident summaries that separate confirmed evidence, analysis, open questions, and recommended next actions.\nRequired Qualifications\nBachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.\n3+ years of hands-on experience in a SOC, incident response, threat detection, security engineering, or closely related operational security role.\nStrong hands-on experience with Microsoft Sentinel, Microsoft Defender, Sophos or comparable EDR platforms, Tenable or comparable vulnerability platforms, and enterprise security monitoring tools.\nIntermediate to advanced KQL skills for investigation, hunting, correlation, and detection development.\nStrong understanding of Microsoft 365 and identity security, including authentication events, MFA, account activity, session behavior, and suspicious access patterns.\nExperience investigating endpoint activity using process trees, file hashes, command lines, persistence indicators, and network connections.\nExperience with AWS or hybrid-cloud security monitoring and cloud security posture or workload protection concepts.\nWorking knowledge of PowerShell or Python for investigation support, data analysis, or security automation.\nExperience documenting incident response findings, developing playbooks, and communicating remediation recommendations.\nStrong technical writing and stakeholder communication skills with the ability to work independently with minimal oversight.\nPreferred Skills and Certifications\nMicrosoft Certified: Security Operations Analyst Associate (SC-200).\nCompTIA CySA+, GIAC Certified Incident Handler (GCIH), Microsoft Cybersecurity Architect Expert, AWS Certified Security - Specialty, or comparable security certification.\nExperience creating or tuning detections in Microsoft Sentinel or comparable SIEM platforms.\nExperience with threat hunting methodologies and mapping observed activity to MITRE ATT&CK techniques when appropriate.\nExperience with ITSM workflows, ticket lifecycle management, and evidence-driven security documentation.\nExperience mentoring junior analysts, performing investigation quality reviews, or helping standardize SOC operating procedures.\nSuccess in This Role\nSuccess is demonstrated through independent investigation quality, defensible findings, effective threat hunting and detection improvement, strong cross-team coordination, and measurable development of junior analysts.","description_format":"text","description_chars":5108,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Contact Center Software"],"lifecycle":[{"event":"open","at":"2026-10-28T00:23:20Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":97500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":88,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.876,"p_room":1,"age_days":9,"expected_fill_days":30,"reasons":["conf:1","velocity","win:early","comp:attention"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/alvaria-security-operations-center-soc-analyst-ii","json_url":"https://alion.io/job/alvaria-security-operations-center-soc-analyst-ii.json","meta":{"generated_at":"2026-11-06T07:08:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12585,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1923389},"rest":"https://alion.io/mcp/rest/get_company?id=1923389"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Falvaria-security-operations-center-soc-analyst-ii"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Falvaria-security-operations-center-soc-analyst-ii"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Falvaria-security-operations-center-soc-analyst-ii"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/alvaria-security-operations-center-soc-analyst-ii\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Falvaria-security-operations-center-soc-analyst-ii"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3369468}},{"tool":"search_jobs","arguments":{"company":"alvaria.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3369468},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}