Security Operations Analyst II

POSITION SUMMARY

1. The SOC Analyst II is responsible for overseeing cybersecurity by monitoring, detecting, investigating, and responding to security incidents within an organization. And act as an escalation from Tier 1 analyst. This role focuses on incident analysis, threat validation, containment actions, and root cause identification, while supporting continuous improvement of SOC detections, playbooks, and threat intelligence integration.

The Level II analyst acts as a technical escalation point, mentoring junior analysts and collaborating closely with Incident Response, Threat Intelligence, and Security Engineering teams

RESPONSIBILITIES

1. Monitor security events and alerts from SIEM (Security Information and Event Management) systems/ SOAR, 7AI Dashboard and other security tools.
2. Perform deep-dive analysis of security alerts escalated by Tier 1 to determine legitimacy, scope, and impact
3. Conduct log correlation and forensic analysis across SIEM, EDR, network, cloud, and identity platforms
4. Analyze and investigate security incidents to determine their impact and root cause.
5. Respond to security incidents, coordinate with stakeholders, and escalate as necessary.
6. Conduct risk analysis to identify security gaps.
7. Develop and implement incident response procedures and playbooks.
8. Collaborate with IT and security teams to improve security configurations and defenses.
9. Document security incidents, findings, and recommendations for future mitigation.
10. Stay updated on the latest cybersecurity threats, trends, and best practices.
11. Identify Indicators of Compromise (IOCs) and attack patterns using threat intelligence and MITRE ATT&CK 
12. Execute containment and remediation actions (e.g., isolate hosts, block indicators, disable accounts)
13. Work with our Security Engineering group for any security application and tools within SOC for enhancement or fine tuning.
14. Assist in threat hunting and proactive security monitoring.
15. Participate in security awareness training and initiatives.

QUALIFICATIONS

1. Candidate must be a degree holder in Computer Science, Computer Engineering, Information Technology or equivalent qualifications 
2. 3-5 years of experience in cybersecurity, SOC operations, or a similar role.
3. Security certifications such as CompTIA Security+, CEH, GSEC, or equivalent.
4. Familiarity with SIEM tools, IDS/IPS, firewalls, and endpoint protection solutions.
5. Knowledge of cybersecurity frameworks such as NIST, MITRE ATT&CK, or ISO 27001.
6. Understanding of networking protocols, operating systems, and security best practices.
7. Strong analytical and problem-solving skills.
8. Strong understanding of incident response lifecycle (NIST / SANS)
9. Hands-on experience with log analysis, endpoint telemetry, and network traffic analysis
10. Ability to analyze malware behavior, lateral movement, persistence, and privilege escalation
11. Excellent communication and documentation abilities.
12. Experience with scripting languages (Python, PowerShell, etc.) for automation.
13. Knowledge of cloud security (AWS, Azure, Google Cloud).
14. Familiarity with forensic analysis and malware investigation techniques.
15. Rotational shifts may be required to support 24/7 security monitoring.
16. Ability to work in a fast-paced and high-pressure environment.