- Location
- Pune, MH, IN · Bengaluru, IN
- Type
- Full-time
- Department
- Engineering
- Experience
- 3+ years
- Closing date
- Today
- Source
- iCIMS
Description
Overview
Position: SOC L2 engineer
(3 to 5 years of experience)
Type: Full Time Employee (FTE)
Roles and Responsibilities:
- Monitor and analyze security alerts generated by SIEM platforms including Elastic SIEM, Microsoft Sentinel, and other SIEM tools (e.g., Wazuh, Splunk, QRadar).
- Perform continuous security monitoring of network traffic, endpoint activity, and system logs to identify suspicious or malicious behavior.
- Investigate potential security incidents by performing detailed log analysis to detect anomalies and attack patterns.
- Classify security alerts accurately as True Positive or False Positive based on evidence and analysis.
- Respond to security incidents promptly by following defined incident response playbooks and SOPs.
- Escalate confirmed or high‑severity incidents to senior SOC engineers with proper documentation, context, and impact analysis.
- Conduct phishing email analysis, including:
o Header and sender analysis
o URL and attachment inspection
o Identification of credential‑harvesting and malware delivery attempts
- Track and investigate malware alerts, performing basic static and behavioral analysis using EDR telemetry and sandbox results.
- Monitor and analyze endpoint activity using EDR tools such as Sentinel One and Microsoft Defender for Endpoint.
- Support vulnerability assessment activities by reviewing scan results, validating findings, and assisting with remediation tracking.
- Maintain accurate incident reports, investigation notes, and SOC documentation.
- Follow daily threat intelligence updates and apply relevant insights to ongoing investigations.
- Adherent to SOC SLAs, escalation procedures, and operational best practices
- Support client Baseline Security Reviews by reviewing security tool configurations and documenting gaps against defined security baselines.
Technology skills and Competencies:
- Basic to intermediate understanding of networking, security, and system administration concepts.
- Knowledge of:
- Network security fundamentals
- Firewalls, IDS/IPS, and SIEM to
- Vulnerability assessment concepts and security best practices
- Familiarity with Windows and/or Linux environments.
- Hands‑on exposure to:
- SIEM monitoring and alert investigation
- Incident response and alert triage
- Endpoint detection and response (EDR) tools •
- Understanding of common attack techniques including phishing, malware, brute force, and credential abuse.
Certifications:
- CEH (Certified Ethical Hacker)
- Microsoft SC‑200 – Security Operations Analyst
- Microsoft SC‑900 or equivalent security fundamentals certification
Qualifications and experience:
- Bachelor’s degree in computer science, Information Security, Information Technology, or a related field (or equivalent practical experience).
- Exposure to SOC operations
- Exposure to Cybersecurity monitoring
- Hands‑on experience with SIEM tools and security alert investigation is preferred.
Skills
LinuxCybersecuritySIEMSOCSplunk
