L2 SOC Lead
- Thiruvananthapuram, Kerala Kochi, Kerala
- Permanent
- Full-time
- SOC Analyst L2 would work closely with SOC L1 team, L3 team & customer and responsible for performing deeper analysis and need to interact with client in daily calls and need to take the responsibility of handling the True Positive incidents on time.
- When L1 escalates an incident to L2, need to conduct more analysis and, if needed, escalate to the customer/L3 team, or L2 analyst must advise L1 team members until the incident is resolved.
- Perform deep analysis to security incidents to identify the full kill chain
- Handle L2 and above level technical escalations from L1 Operations team and resolve within SLA.
- Identify the security gaps and need to recommend new rules/solution to L3/Customer
- Need to suggest finetuning for existing rules based on the high count/wherever required
- Create and manage the Incident handling playbook, process runbooks and ad-hoc documents whenever needed
- Respond to clients’ requests, concerns, and suggestions
- Proactively support L1 team during an incident.
- Performs and reviews tasks as identified in a daily task list.
- Ready to work in 24x7 rotational shift model including night shift
- Incident detection, triage, analysis and response.
- Coordinating with customers for their security related problems and providing solutions.
- Share knowledge to other analysts in their role and responsibilities
- Provide knowledge transfer to L1 such as advance hunting techniques, guides, cheat sheets etc
- Experience of Managing L2 resources in a multi-location basis.
- Minimum of 3 years of experience in Cyber security, SOC
- At least 2 years of working in the SOC
- Proficient in Incident Management and Response
- Experience in leading a team of more than 9 analysts
- Experience in searching and log analysis in at least 2 of the below SIEM tools or more than 3 SIEM in total: Sentinel, QRadar, Splunk, LogRhythm, Google Chronicle
- Experience in analysis and response in at least 2 of the below EDR tools or more than 3 EDR in total:Crowd strike, MS Defender, Carbon Black, Cybereason, Sentinel One
- In-depth knowledge of security concepts such as cyber-attacks and techniques, threat vectors, risk management, incident management etc.
- Up to date in cyber security and incidents; intermediate understanding of enterprise IT Infrastructure including Networks Firewalls OS Databases Web Applications etc.
- Understanding of ISMS principles and guidelines; relevant frameworks (e.g. ISO27001)
- Desirable – Training / Certification in Ethical Hacking/SIEM Tool etc.
- Strong verbal and written English communication
- Strong interpersonal and presentation skills
- Ability to work with minimal levels of supervision
- Responsible for working in a 24x7 Security Operation centre (SOC) environment.
- Knowledge and hands-on experience with Azure Sentinel, Microsoft 365 Defender, Microsoft Defender for Cloud Apps & Identity Protection.
- Ensure completion of learning programs as suggested by Managers
- Suggest ideas that will help innovation and optimization of processes. Help develop the ideas into proposals.
- Provide suggestions to reduce the manual work Teamwork
- Assist L1 team members where possible.