SENIOR SOC ANALYST

Job Description:

WORKING DAYS & HOURS

• 5 Days Working (Rotational Shift)
• Work From Office

JOB LOCATION

A Security Operations Center (SOC) continuously monitors and analyzes an organization's security environment to detect, investigate, and respond to potential cyber threats. The Senior SOC Analyst is responsible for handling advanced security investigations, analyzing security alerts, improving threat detection capabilities, and supporting incident response activities. The role also involves guiding and mentoring L1 and L2 SOC team members, assisting with complex security incidents, improving SOC processes, and ensuring timely and effective incident resolution.

KEY RESPONSIBILITIES:

1. Security Monitoring and Incident Investigation

• Monitor and analyse security alerts from SIEM, EDR, and other security monitoring tools.
• Investigate suspicious activities, identify potential threats, and determine the severity and impact of security incidents.
• Perform detailed analysis of security events and recommend appropriate mitigation measures.
• Handle complex security incidents escalated by L1 and L2 analysts.

2. Incident Response and Escalation Management

• Investigate, contain, and support the resolution of security incidents within defined SLAs.
• Escalate critical incidents to the SOC Lead or relevant stakeholders with proper analysis and documentation.
• Provide actionable remediation recommendations to prevent recurring security incidents.
• Support root cause analysis and post-incident reviews.

3. SIEM and EDR Management

• Work with SIEM and EDR tools to investigate alerts, correlate events, and identify suspicious patterns.
• Assist in developing and improving detection rules, use cases, and alert-handling procedures.
• Identify gaps in existing detection mechanisms and recommend improvements.
• Help reduce false positives and improve the accuracy of security alerts.

4. Threat Hunting and Threat Intelligence

• Perform proactive threat hunting to identify potential threats that may not be detected by existing monitoring systems.
• Analyze threat intelligence reports, indicators of compromise (IOCs), and emerging attack techniques.
• Apply threat intelligence findings to improve detection and investigation processes.
• Stay updated on current cybersecurity threats, vulnerabilities, and attack methodologies.

5. Mentoring and Guiding L1 and L2 Team Members

• Mentor and guide L1 and L2 SOC analysts in alert triage, investigation techniques, incident handling, and escalation procedures.
• Assist junior team members in resolving complex security alerts and improving their technical skills.
• Conduct knowledge-sharing sessions and provide constructive feedback to improve team performance.
• Support the development of standard investigation procedures and best practices across the SOC team.

6. SOC SLA and Response Quality

• Ensure security alerts and incidents are investigated and resolved within defined SLAs.
• Review incident tickets and investigation reports for accuracy, completeness, and quality.
• Identify delays or recurring issues in incident handling and recommend corrective actions.
• Maintain consistency in incident classification, prioritization, and escalation.

7. Documentation and Reporting

• Prepare detailed incident investigation reports, technical findings, and remediation recommendations.
• Maintain accurate records of security alerts, incident tickets, investigation steps, and resolutions.
• Document investigation procedures, detection logic, and lessons learned from security incidents.
• Assist in preparing client-facing security reports and other SOC deliverables, as required.

8. Vulnerability and Security Event Analysis

• Analyze security vulnerabilities, suspicious activities, and potential attack vectors relevant to the organization's environment.
• Support vulnerability assessment findings and coordinate with relevant teams for remediation, where required.
• Assist in identifying security gaps and recommending measures to strengthen the organization's security posture.

9. Process Improvement and Collaboration

• Identify opportunities to improve SOC workflows, incident response procedures, and operational efficiency.
• Collaborate with L1/L2 analysts, SOC Leads, threat intelligence teams, and other technical teams to resolve security issues.
• Assist in testing new security tools, detection use cases, and investigation techniques.
• Support the implementation and maintenance of SOC processes, playbooks, and standard operating procedures.

10. Compliance and Other Responsibilities

• Follow established security policies, procedures, and applicable compliance requirements.
• Ensure investigation activities and reports meet organizational and client requirements.
• Perform other security-related duties and responsibilities as assigned by management.

REQUIREMENT:

1. Relevant experience in team lead 2+ years and overall 5+ years.
2. Relevant experience in a Security Operations Center (SOC) or cybersecurity operations role.
3. Strong understanding of security monitoring, alert triage, incident investigation, and incident response.
4. Hands-on experience with SIEM and EDR tools.
5. Knowledge of network security, endpoint security, common attack techniques, and security event analysis.
6. Understanding of threat intelligence, indicators of compromise (IOCs), and threathunting techniques.
7. Experience in handling escalated security incidents and providing technical guidance to junior analysts.
8. Strong analytical, troubleshooting, documentation, and communication skills.
9. Ability to work in a shift-based SOC environment, if required.