Job Summary
Security SOC Analyst - Managed Services (L2) Role Summary The Security Operations Center (SOC) Analyst - L2 is responsible for advanced security monitoring, incident investigation, threat analysis, and incident response activities. The analyst serves as the escalation point for L1 analysts, performs detailed forensic analysis of security incidents, identifies emerging threats, and drives remediation efforts to protect organizational assets.
Key Responsibilities
Key Responsibilities Perform detailed investigation and analysis of escalated security incidents. Conduct advanced threat analysis using SIEM, EDR/XDR, threat intelligence, and security monitoring tools. Validate, contain, and coordinate remediation of security incidents. Lead incident handling activities for medium and high-severity security events. Correlate events from multiple security tools to identify attack patterns and indicators of compromise (IOCs). Perform malware analysis, phishing investigations, and endpoint compromise assessments. Review and tune SIEM use cases, correlation rules, and detection mechanisms. Support threat hunting activities to identify hidden threats within the environment. Develop and maintain incident response playbooks and operational procedures. Provide technical guidance and mentoring to L1 analysts. Coordinate with infrastructure, network, application, and customer teams during incident investigations. Prepare incident reports, root cause analysis (RCA), and executive summaries. Participate in security assessments, purple team exercises, and incident response drills. Identify opportunities for automation and process optimization. Incident Response & Investigation Incident Handling Lifecycle Threat Detection and Analysis Malware Investigation Phishing Analysis Digital Forensics Fundamentals IOC and TTP Analysis MITRE ATT&CK; Framework Typical L2 Responsibilities in a Managed SOC Environment Analyze and respond to escalated alerts from L1. Investigate ransomware, phishing, malware, insider threat, and account compromise incidents. Create and optimize Microsoft Sentinel analytics rules and workbooks. Perform KQL-based log analysis and threat hunting. Coordinate with customers during incident response activities. Produce detailed incident reports and remediation recommendations. Support continuous improvement of SOC processes and detection capabilities.
Skill Requirements
Key Responsibilities Perform detailed investigation and analysis of escalated security incidents. Conduct advanced threat analysis using SIEM, EDR/XDR, threat intelligence, and security monitoring tools. Validate, contain, and coordinate remediation of security incidents. Lead incident handling activities for medium and high-severity security events. Correlate events from multiple security tools to identify attack patterns and indicators of compromise (IOCs). Perform malware analysis, phishing investigations, and endpoint compromise assessments. Review and tune SIEM use cases, correlation rules, and detection mechanisms. Support threat hunting activities to identify hidden threats within the environment. Develop and maintain incident response playbooks and operational procedures. Provide technical guidance and mentoring to L1 analysts. Coordinate with infrastructure, network, application, and customer teams during incident investigations. Prepare incident reports, root cause analysis (RCA), and executive summaries. Participate in security assessments, purple team exercises, and incident response drills. Identify opportunities for automation and process optimization. Incident Response & Investigation Incident Handling Lifecycle Threat Detection and Analysis Malware Investigation Phishing Analysis Digital Forensics Fundamentals IOC and TTP Analysis MITRE ATT&CK; Framework Typical L2 Responsibilities in a Managed SOC Environment Analyze and respond to escalated alerts from L1. Investigate ransomware, phishing, malware, insider threat, and account compromise incidents. Create and optimize Microsoft Sentinel analytics rules and workbooks. Perform KQL-based log analysis and threat hunting. Coordinate with customers during incident response activities. Produce detailed incident reports and remediation recommendations. Support continuous improvement of SOC processes and detection capabilities.