SENIOR ENGINEER - SOC Monitoring

Job Description:
SOC Incident Response + Threat Intelligence / Threat Hunting (L2)
Position Title
L2 Security Analyst SOC Incident Response, Threat Intelligence & Threat Hunting
Experience
4 to 6 years in Cyber Security Operations, Incident Response, Threat Intelligence, and Threat Hunting
Location
Flexible / Hybrid / Onsite
Role Summary
We are looking for an experienced L2 SOC Security Analyst with strong expertise in Incident Response (IR), Threat Intelligence (TI), and proactive Threat Hunting. The candidate will act as a senior escalation point for high-severity security incidents, conduct advanced investigations, develop threat hunting hypotheses, and provide actionable intelligence to improve the organization's overall security posture.
The role requires hands-on expertise across SIEM, EDR/XDR, network security monitoring, malware analysis, threat intelligence platforms, and cloud security monitoring.
Key Responsibilities
Incident Response & Security Operations
Lead investigation and response activities for complex security incidents including:
Ransomware
Advanced Persistent Threats (APT)
Insider threats
Credential compromise
Web application attacks
Cloud security incidents
Data exfiltration
Lateral movement
Privilege escalation
Perform advanced triage and root cause analysis using:
SIEM
EDR/XDR
Network telemetry
Threat intelligence feeds
Cloud logs
Endpoint forensics
Handle L2 escalations from L1 SOC analysts.
Conduct incident containment, eradication, and recovery coordination.
Develop and improve:
Incident response playbooks
Detection use cases
Correlation rules
SOC runbooks
Automation workflows
Coordinate with infrastructure, cloud, application, and business teams during major incidents.
Prepare executive and technical incident reports with actionable recommendations.
Threat Intelligence Responsibilities
Monitor and analyze cyber threat intelligence from:
Commercial TI platforms
Open-source intelligence (OSINT)
Government/CERT advisories
Dark web monitoring
Vendor threat reports
Enrich alerts with Indicators of Compromise (IOCs), TTPs, malware intelligence, and adversary attribution.
Map adversary activities to:
MITRE ATT&CK
Cyber Kill Chain
Diamond Model
Analyze emerging threats, zero-days, ransomware campaigns, and targeted attack trends.
Provide strategic and operational threat advisories to SOC and leadership teams.
Create threat intelligence reports, executive summaries, and threat landscape assessments.
Threat Hunting Responsibilities
Conduct proactive threat hunting using hypothesis-driven methodologies.
Hunt for:
Persistence mechanisms
Beaconing activity
Credential dumping
Living-off-the-land (LOLBins)
Command & Control (C2)
Suspicious PowerShell activity
Lateral movement
Cloud anomalies
Use telemetry from:
SIEM
EDR/XDR
DNS
Proxy
Firewall
Identity systems
Cloud platforms
Develop custom queries and analytics for detecting stealthy attacker behavior.
Identify detection gaps and recommend logging improvements.
Convert hunt findings into production-grade detection use cases.
Required Technical Skills
SIEM & Security Monitoring
Strong hands-on experience with one or more:
IBM QRadar
Microsoft Sentinel
Splunk Enterprise Security
ArcSight
LogRhythm
EDR/XDR Technologies
Experience with:
CrowdStrike Falcon
Microsoft Defender for Endpoint
SentinelOne
Palo Alto Cortex XDR
Threat Intelligence Platforms
Experience with:
Recorded Future
Anomali ThreatStream
MISP
ThreatConnect
Cloud & Infrastructure Security
Knowledge of:
Amazon Web Services security monitoring
Microsoft Azure security services
Google Cloud Platform logging and detections
Identity security and IAM monitoring
Container/Kubernetes security basics
Investigation & Analysis Skills
Malware triage and behavioral analysis
Windows/Linux forensic analysis
Memory and disk artifact analysis
Packet analysis using Wireshark
Threat actor TTP analysis
IOC enrichment and validation
Scripting & Automation
Good knowledge of:
Python
PowerShell
KQL
SPL
Regex
API integrations
SOAR automation
Desired Certifications
Preferred certifications include:
GIAC Certified Incident Handler (GCIH)
GIAC Certified Forensic Analyst (GCFA)
GIAC Certified Intrusion Analyst (GCIA)
Certified Threat Intelligence Analyst (CTIA)
EC-Council Certified Ethical Hacker (CEH)
ISC2 CISSP
Security vendor certifications
Key Competencies
Strong analytical and investigative mindset
Excellent communication and stakeholder management
Ability to work during high-pressure incidents
Deep understanding of attacker methodologies
Strong documentation and reporting capability
Mentoring and guidance for junior analysts
Ability to independently lead investigations
Preferred Exposure
MDR/MSSP environment
Healthcare / BFSI / Critical infrastructure domains
Threat hunting frameworks
Purple team exercises
MITRE ATT&CK-based detection engineering
SOAR platforms and automation
Cloud-native SOC operations
Typical Deliverables
Incident investigation reports / RCA
Threat intelligence advisories
Hunting reports and findings
Detection use cases
IOC/TTP repositories / MITRE
Executive risk summaries
Threat landscape assessments
SOC maturity improvement recommendations
Presentation skills
Communication skills
Show more Show less