SOC L2

About the Role
The SOC Analyst will provide unparalleled support to our customer and embark on an exciting and rewarding career in the field of information security. This role involves working with multiple solutions, including SIEM, SOAR, log management, EDR, and vulnerability management to investigate and respond to security-related incidents and alerts. The SOC Analyst will be responsible for several key tasks central to maintaining and improving the security posture of organizations.

Responsibilities

• Triage and investigate assigned incidents.
• Create incident reports that document all investigation steps, lessons learned, and recommended actions.
• Modify use cases for false positive incidents.
• Create and modify use cases, dashboards, and reports.
• Engage in threat hunting activities.
• Integrate with threat intelligence feeds.
• Evaluate security products.
• Conduct vulnerability assessments and penetration testing.
• Develop and modify runbooks for L1 and NOC teams, ensuring proper execution.
• Produce detailed reports analyzing threats and Indicators of Compromise (IoCs), including recommended actions.
• Provide communication and escalation through incidents as per SOC guidelines.
• Communicate directly with data asset owners and business response plan owners during high severity incidents.
• Analyze log files from various log sources.
• Manage support issues from start to finish, adhering to documented escalation procedures.
• Ensure threat feeds are received, aggregated, reviewed, and acted upon accordingly.

Qualifications
Experience and Qualifications:

• 4+ years of hands-on experience in the information security domain.
• 3+ years of experience in SOC/NOC environments.
• Expert knowledge in SIEM solutions, including:
  • Creating use cases, dashboards, and reports.
  • Integration with threat intelligence feeds.
  • Running complex queries.
• Advanced hands-on experience with vulnerability assessments and penetration testing.
• Advanced knowledge of network attacks such as DoS and their countermeasures.
• Advanced knowledge of web application attacks and their countermeasures.
• Advanced knowledge of hacking tools and their capabilities, including NMAP and Metasploit.
• Advanced scripting knowledge for automation configuration.
• Advanced understanding of the attack kill chain and incident response procedures.
• Advanced knowledge of Windows and Linux/Unix operating systems.
• Moderate knowledge of forensic investigations.
• Strong analytical skills applicable in threat hunting and incident investigation.

Good to Have:

• 6+ years in security / 4+ years in SOC operations.
• GIAC Certified Incident Handler (GCIH).
• SANS FOR508 Advanced Digital Forensics, Incident Response, and Threat Hunting (GCFA).
• SANS FOR610 Reverse-Engineering Malware: Malware Analysis Tools and Techniques (GREM).
• Offensive Security Certified Professional (OSCP).
• University degree in Computer Science/Information Technology from a recognized institution.