Enterprise Senior Analyst-Cyber security

The Senior SOC Analyst (L2) is responsible for advanced threat detection, investigation and incident response within a 24x7 SOC environment leveraging CrowdStrike Falcon EDR and enterprise SIEM platforms.
In line with the organization chart, this role handles incidents escalated from the Tier I team, provides Tier II threat hunting support, delivers engineering support for detection tuning and use-case development, and produces the monthly threat report.
Incident Management
Escalated Incident Investigation & Validation
• Investigate and validate all alerts and incidents escalated by the Tier I team
• Perform deep endpoint analysis in CrowdStrike Falcon (detections, process trees, RTR)
Incident Response & Containment (P1/P2)
• Execute containment for high-severity incidents – host isolation, IOC blocking, RTR remediation
• Lead technical discussion on incident bridge calls and coordinate with customer and internal teams
Root Cause Analysis (RCA)
• Conduct RCA for P1/P2 and recurring incidents
• Recommend remediation and preventive controls
Proactive Threat Hunting
• Run hypothesis-driven hunts aligned with MITRE ATT&CK, using Falcon and SIEM data
• Hunt for phishing and lateral-movement activity using current threat intelligence
• Perform retro-hunts for newly published IOCs / TTPs across customer environments
SIEM & EDR Detection Engineering
• Tune SIEM correlation rules and Falcon detection / prevention policies
• Develop and test new use cases; manage IOC lists and exclusions in Falcon
• Validate log-source onboarding and health; raise gaps with the engineering team
• Maintain SOC playbooks and runbooks for Tier I and Tier II
Monthly Threat Report & Documentation
• Compile the monthly threat report – incident statistics, trends, notable incidents, hunt results, threat landscape and recommendations
• Prepare detailed incident reports and executive summaries
Qualitifications
• 4–8 years in SOC / Managed Security environment
• Minimum 2+ years in L2 incident handling
• Experience in 24x7 SOC operations
• Strong analytical, documentation, and communication skills
Desired Knowledge, Skills
• CEH | Security+ | CySA+ | GCIH | CrowdStrike Certification
• Strong knowledge of windows operating system-based analysis like process tree, Event ID’s, PowerShell logging.
• Hands-on CrowdStrike Falcon experience / Certifications like CrowdStrike CCFR (Responder) or CCFH (Hunter) is preferred.
• An understanding of a wide array of server grade applications such as: DBMS, Exchange, DNS, SMTP, IIS, Apache, SharePoint, Active Directory, Identity Management, Patch Management, LDAP, SQL, and others
• Experience in Hypothesis-driven hunting mapped to MITRE-ATTACK framework.
• Exposure to SOAR playbook, writing & tuning correlation rules
Competencies:
• Interpersonal relationship
• Problem solving and critical analysis
• Achievement orientation
• Time management
• Team collaboration
• Process quality orientation
• Customer orientation
• Documentation skills
• Continuous learning and improvement
Interaction (Internal and External)
• Internal SOC and Security Operations Team
• Internal Leadership and business stakeholders

Work arrangement
No