SOC Analyst

About This Role

A SOC Analyst Level 2 (L2) is responsible for advanced threat detection, incident investigation, and

response. This role acts as an escalation point for L1 analysts and leverages SIEM and SOAR platforms

to automate and orchestrate security operations.

Key Responsibilities

➢ Monitoring & Analysis

• Monitor security alerts from Splunk SIEM tool.

• Perform deep-dive analysis on escalated alerts from L1 analysts

• Identify false positives vs. real security incidents

• Correlate logs from multiple sources (firewalls, endpoints, proxy, email, IDS/IPS etc.)

➢ Incident Response

• Investigate and respond to security incidents (malware, phishing, insider threats, etc.)

• Conduct root cause analysis and impact assessment

• Execute containment, eradication, and recovery actions

• Document incidents and maintain case records

➢ SOAR Responsibilities

• Use SOAR platforms (e.g., Fortinet SOAR)

• Develop, modify, and optimize playbooks/runbooks

• Automate repetitive tasks (alert triage, enrichment, ticket creation)

• Perform automated response actions (block IPs, disable users, isolate endpoints etc..)

➢ Threat Intelligence & Hunting

• Analyze threat intelligence feeds and indicators of compromise (IOCs)

• Perform proactive threat hunting using logs and behavioural analysis

• Stay updated on latest threats, vulnerabilities, and attack techniques (MITRE ATT&CK)

➢ Reporting & Documentation

• Create incident reports and dashboards

• Provide recommendations to improve detection and response

• Maintain SOPs, playbooks, and knowledge base

➢ Collaboration

• Work with L1 analysts for guidance and escalation handling

• Coordinate with IT, network, and security teams

• Support compliance and audit requirements

Required Skills

➢ Technical Skills

• Strong experience with Splunk SIEM tool.

• Hands-on experience with any SOAR platforms.

• Knowledge of:

o Network security (TCP/IP, DNS, HTTP/S)

o Operating systems (Windows, Linux)

o Log analysis and correlation

• Familiarity with:

o EDR tools (Symantec)

o NDR tools (Vectra AI)

o Firewalls, IDS/IPS, Proxy (Bluecoat, Palo Alto, Cisco)

➢ Soft Skills

• Strong analytical and problem-solving skills

• Good communication and reporting abilities

• Ability to work in shifts (24/7 SOC environment)

• Attention to detail and quick decision-making

➢ Qualifications

• Bachelor’s degree in Cybersecurity / IT / Computer Science (or equivalent)

• 3–5 years of experience in SOC or cybersecurity operations

Preferred Certifications

• CompTIA Security+

• CEH (Certified Ethical Hacker)

• Splunk Certified Power User / Admin

• GIAC (GCIA, GCIH)

• SOAR platform certifications (if available)