Security Analyst - L2

Role Overview The SOC L2 Analyst is responsible for in-depth security investigation, incident analysis, and response coordination across enterprise environments. This role focuses on correlating multi-domain telemetry (SIEM, EDR/XDR, Cloud, DLP, DAM, Email Security) to determine root cause, assess impact, and recommend containment actions. The analyst acts as a technical escalation point for L1 and contributes to improving detection use cases and SOC maturity.

Key

Responsibilities Perform deep-dive investigations on alerts from across SIEM, EDR/XDR, Cloud, DLP, DAM, and Email Security tools Correlate logs and telemetry to reconstruct attack timelines and identify root cause Investigate advanced threats such as lateral movement, privilege escalation, account compromise, and malware activity Conduct endpoint analysis (process injection, persistence mechanisms, suspicious binaries, command-line artifacts) Analyze cloud security incidents (Azure/AWS) including IAM misuse, impossible travel, token abuse, and misconfigurations Perform advanced phishing and BEC investigations, including header analysis, URL detonation, and payload inspection Investigate DLP (Netskope) alerts for potential data exfiltration, policy violations, and insider threats Analyze data movement patterns across endpoints, email, and cloud storage Tune and validate DLP policies to reduce false positives and improve detection accuracy Investigate DAM alerts for unauthorized database access, privilege misuse, abnormal query patterns, and potential SQL injection attempts Correlate database activity with user identity and endpoint behavior to detect malicious intent Lead incident investigation and provide containment/remediation recommendations Create and enrich IOCs (IP, domain, hash) and perform threat intelligence lookups Ensure timely escalation to L3/IR teams for critical incidents (P1/P2) Improve and tune SIEM use cases and detection rules to reduce false positives Maintain detailed incident documentation, timelines, and reporting Support threat hunting activities using SIEM and EDR tools Required Qualifications 3 to 6 years of experience in SOC / Cyber Security Operations / Incident Response Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field Strong hands-on experience with SIEM platforms (Sentinel, Splunk, QRadar, ArcSight) Experience with EDR/XDR tools (Microsoft Defender, CrowdStrike, SentinelOne) Practical knowledge of cloud security monitoring (Azure, AWS, GCP) Experience in Netskope DLP and Database Activity Monitoring alert investigations Understanding of email security solutions and phishing/BEC analysis Relevant certifications: CySA+, CCSP, CEH, GCIA, GCIH, SC-200, Splunk Certified Core Competencies Strong knowledge of MITRE ATT&CK framework and attack lifecycle mapping Ability to correlate events across endpoint, network, cloud, and database layers Proficiency in SIEM query languages (KQL, etc.) Solid understanding of network protocols, authentication mechanisms, and log analysis Experience in incident handling, root cause analysis, and attack chain reconstruction Strong analytical and problem-solving skills with attention to detail Ability to work independently and mentor L1 analysts Effective communication skills for technical and non-technical stakeholders Ability to work in a 24x7 rotational shift environment