Senior Security Analyst SOC

As Senior Security Analyst you will perform advanced investigations and validation of security alerts and incidents to ensure accurate threat identification and effective response. You will play a key role in improving detection quality monitoring effectiveness and operational excellence across the Security Operations Center (SOC).

You will be accountable for leading technical investigations mentoring SOC Analysts enhancing detection capabilities and ensuring timely identification analysis escalation and documentation of security incidents.

Reporting to theSenior Manager Service Operations you will be part of the SOC Team responsible for monitoring detecting investigating and responding to cybersecurity threats across the enterprise while continuously improving SOC processes tools and capabilities.

• Serve as the primary escalation point for SOC Analysts during complex security investigations and incident analysis.
• Lead technical investigations of security alerts and incidents across endpoint network identity cloud and application environments.
• Validate alert classifications severity ratings incident scope and escalation decisions to ensure investigation quality and consistency.
• Perform advanced correlation and analysis across SIEM EDR/XDR cloud identity network and endpoint telemetry.
• Build investigation timelines collect evidence document findings and support escalation decisions in accordance with incident response procedures.
• Escalate confirmed or suspected security incidents to the Security Incident Response Team (SIRT) and collaborate throughout the response lifecycle.
• Develop maintain optimize and tune detection rules correlation logic SOC use cases and investigation playbooks to improve detection effectiveness.
• Identify false positive trends detection gaps and monitoring deficiencies and drive continuous improvements to monitoring capabilities.
• Mentor SOC Analysts through technical coaching investigation support quality reviews and knowledge sharing.
• Support vulnerability management activities cyber simulations tabletop exercises post-incident reviews and continuous SOC improvement initiatives.

• You have 3-5 years of experience as a SOC L2 Analyst or in an equivalent Security Operations role.
• You possess advanced experience investigating security events using SIEM and EDR/XDR platforms preferably Elastic Cortex XDR Microsoft Defender XDR and CrowdStrike Falcon.
• You have experience analyzing logs and telemetry from endpoints identity platforms cloud services firewalls proxies DNS VPN and applications.
• You have proven experience developing tuning and optimizing detection rules correlation logic and SOC use cases.
• You demonstrate a strong understanding of the incident investigation triage escalation and response lifecycle.
• You are proficient in security query languages such as KQL Lucene EQL and Sigma.
• You have working knowledge of PowerShell and/or Python for security investigations automation and operational efficiency.
• You possess solid knowledge of Windows Linux Active Directory Microsoft 365 Azure/AWS networking and common attack techniques.
• You have strong practical knowledge of the MITRE ATT&CK framework and its application to detection engineering and security monitoring.
• You hold a Bachelors degree in Information Technology Cybersecurity Computer Science or a related field along with at least one recognized cybersecurity certification such as SC-200 GCIH GCIA CySA or ECIH.
  
  NICE-TO-HAVE
  • Experience supporting Vulnerability Management activities including vulnerability validation risk prioritization and remediation tracking.
  • Experience participating in cyber simulations red-team exercises tabletop exercises and post-incident reviews.
  • Familiarity with security automation orchestration technologies and operational reporting for SOC performance metrics.