SOC Analyst II

We are building a next-generation Security Operations Center (SOC) designed for the AI-first era. We are moving beyond traditional reactive methods to build an intelligent, automated SOC that leverages deep cloud security expertise to stop advanced threats.

We are seeking a motivated and detail-oriented L2 SOC Analyst to be a core member of our 24/7 operations team. This role is for a hands-on analyst who excels at investigating complex alerts, using automation to accelerate response, and is passionate about cloud security. You will be the primary line of in-depth analysis, working to validate, investigate, and contain threats as

they are escalated from L1.

Please note: This is a 24/7 operational role. The SOC team works in three rotating shifts (morning, afternoon, and night) to ensure continuous monitoring and response.

What You Will Be Doing

Incident Triage & Investigation

• Serve as the primary escalation point for alerts triaged by L1 analysts.
• Conduct detailed analysis of security alerts from a wide range of sources (SIEM, EDR, CSPM, Cloud-native tools) to validate threats and determine their scope.
• Investigate security incidents in our enterprise and cloud environments (AWS, Azure, GCP), correlating data to build a complete picture of attacker activity.
• Perform deep-dive analysis of logs, kubernetes containers, and endpoint data to identify indicators of compromise (IOCs).

Incident Response & Automation

• Execute and tune automated response playbooks using our SOAR platform for common security incidents.
• Perform timely incident response actions, such as isolating compromised hosts, blocking

malicious IPs/domains, and disabling compromised accounts.

• Utilize and modify existing scripts (primarily Python) to assist with automated evidence collection and enrichment.
• Document all investigation steps, findings, and containment actions in our incident management system.

Threat Hunting & Cloud Monitoring

• Participate in hypothesis based threat hunting campaigns based on new threat intelligence or hypotheses developed by senior analysts.
• Actively monitor and analyze security logs from cloud-native tools (e.g., AWS GuardDuty, CloudTrail,Cloudflare, Azure,etc.) and kubernetes containers.
• Assist in tuning detection rules and identifying false positives to help improve the fidelity of our security alerts.

Continuous Improvement & Collaboration

• Escalate complex, high-severity, or unresolved incidents to L3 Analysts and the Incident Response team with detailed handover notes.
• Contribute to the refinement of SOC documentation, including Standard Operating Procedures (SOPs) and investigation runbooks.
• Provide guidance and mentorship to L1 analysts on triage techniques and alert analysis.

What You Bring

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
• Willingness and ability to work in a 24/7 rotational shift environment (morning, afternoon, and night).
• 4-6 years of experience in a Security Operations (SOC) environment, with demonstrated L2 capabilities.
• Cloud & Container Security Experience: Hands-on experience monitoring and responding to alerts in at least one major cloud provider (AWS, Azure, or GCP); fundamental knowledge on container security
• Technical Expertise: Strong, hands-on experience with SIEM (e.g., CrowdStrike, Splunk, QRadar, Azure Sentinel) and EDR (e.g., CrowdStrike, SentinelOne) platforms.
• AI/Automation Familiarity: Experience using a SOAR platform and familiarity with AI tools and their practical implementation.
• Strong working knowledge of the MITRE ATT&CK framework and its application to

incident analysis.

Why Join Us

• Be at the forefront of a modern, cloud-focused Security Operations Center.
• Gain deep, hands-on experience with cutting-edge cloud security, automation, and threat intelligence technologies.
• A clear career path for growth into L3, threat hunting, or automation engineering roles.
• Collaborate with world-class security and engineering leaders in a high-impact, operational role.