Job Summary
Job Summary : We are seeking an experienced SOC L3 Analyst to support 24x7 Security Operations Center (SOC) activities, including security monitoring, incident investigation, threat hunting, incident response, and SIEM optimization. The analyst will perform deep-dive analysis on escalated security incidents, coordinate containment activities, and enhance detection capabilities across the security monitoring ecosystem.
Key Responsibilities
Job Responsibilities : Key Responsibilities Threat Monitoring & Analysis Monitor and analyse security alerts generated from SIEM platforms. Perform in-depth investigation of escalated incidents from L1 analysts. Validate true positives and eliminate false positives. Correlate events across multiple security technologies. Incident Investigation & Response Conduct detailed incident investigations and root cause analysis (RCA). Analyze logs from Windows, Linux, Firewalls, EDR/XDR, Cloud, and Identity platforms. Identify Indicators of Compromise (IOCs) and attack patterns. Support containment, eradication, and recovery activities. Threat Hunting Perform proactive threat hunting using SIEM, EDR, and threat intelligence feeds. Develop hypothesis-driven hunting scenarios. Identify advanced threats, insider threats, and suspicious activities not detected by existing controls. SIEM & Detection Engineering Fine-tune SIEM correlation rules and detection use cases. Reduce false positives and improve alert fidelity. Map detection content to MITRE ATT&CK; techniques. Support onboarding of new log sources and use cases. Automation & SOAR Support SOAR playbooks and automated response workflows. Integrate security tools with ticketing platforms such as ServiceNow. Identify opportunities for automation of repetitive SOC activities. Reporting & Documentation Document incidents, findings, recommendations, and lessons learned. Prepare security incident reports and management dashboards. Maintain SOPs, runbooks, knowledge articles, and escalation procedures. Collaboration Work closely with L1 Analysts, L3 Engineers, Threat Hunters, and Incident Response teams. Coordinate remediation activities with IT infrastructure and application teams. Participate in customer discussions and security reviews when required. Required Technical Skills Security Monitoring & SIEM Microsoft Sentinel Sentinel ArcSight Endpoint & Network Security Microsoft Defender XDR CrowdStrike Falcon Palo Alto Firewall Check Point Cisco Security Products Security Knowledge Incident Response Threat Hunting MITRE ATT&CK; Framework Kill Chain Methodology Malware Analysis Basics IOC Analysis Log Correlation Query Languages KQL (Microsoft Sentinel) SPL (Splunk) Regular Expressions (Regex) Ticketing & ITSM ServiceNow Jira Cloud Security Microsoft Azure Security Microsoft Defender for Cloud AWS Security Services Qualifications Bachelor\'s degree in Computer Science, Cybersecurity, Information Security, or related field. 4+ years of experience in SOC Operations, Incident Response, or SIEM Monitoring. [SOC_JD_L2_L3 | Word] Strong understanding of network, endpoint, and cloud security concepts. Experience working in a 24x7 SOC environment. Preferred Certifications SC-200: Microsoft Security Operations Analyst SC-100: Microsoft Cybersecurity Architect CompTIA Security+ CEH CySA+ GCIH GCIA CISSP (Preferred) Key Performance Indicators (KPIs) Mean Time to Detect (MTTD) Mean Time to Respond (MTTR) SLA Compliance (%) Incident Investigation Accuracy Threat Hunting Coverage False Positive Reduction Use Case Optimization Knowledge Base Contribution Customer Satisfaction Score (CSAT) Experience: 8–10 Years Role: SOC Analyst – L3 (Tier 2) Shift: 24x7 Rotational Support Location: Chennai
Skill Requirements
Skill Requirement : We are seeking an experienced SOC L3 Analyst to support 24x7 Security Operations Center (SOC) activities, including security monitoring, incident investigation, threat hunting, incident response, and SIEM optimization. The analyst will perform deep-dive analysis on escalated security incidents, coordinate containment activities, and enhance detection capabilities across the security monitoring ecosystem.