Analyst II - SIEM/SecOps

Responsibilities:

1. Monitoring & Escalation Handling
Perform full-time monitoring alongside L1, actively working the alert queue during high-volume periods, while also handling escalations from L1 analysts.
Act as the primary escalation point for all L1-escalated alerts and incidents; receive and validate escalated alerts/incidents, performing deeper investigation to confirm scope, impact, and root cause.
Perform detailed investigation, log correlation, and root-cause analysis across multiple data sources — AWS, Kubernetes, Cloudflare, Azure logs, Defender, and Linux/macOS endpoints.
Write and run OpenSearch Query DSL / Lucene queries directly against raw log data to pivot, correlate, and build full incident timelines (this is the primary analysis method — there is no GUI-driven investigation path).
Determine incident severity, scope, and business impact; validate true positive vs. false positive at a deeper level.
Escalate confirmed major/high-severity incidents to the L3/Incident Response team or CSIRT leadership per the incident response plan, including a full technical summary, supporting evidence, and recommended actions.
Coordinate with L3/Incident Response teams for complex or high-severity incidents.
2. Threat Analysis & Detection Support
Conduct threat hunting based on IOCs, IOAs, and threat intelligence feeds.
Support ideation and testing of new detection use cases, correlation rules, and dashboards, in coordination with the detection engineering/L3 team.
Identify and report logging/health issues (e.g., missing logs, parser errors, data source outages) for timely resolution.
Tune and recommend improvements to detection rules, correlation logic, and SIEM use cases based on false positives/negatives observed during investigations; develop tested tuning solutions and hand them to L3 analysts and build teams for deployment.
Create new detection use cases, tune existing correlation rules, build/modify dashboards, develop and refine UEBA rules, and map detections to the MITRE ATT&CK framework for coverage visibility.
3. Playbook, SOP & Knowledge Management
Develop and refine investigation steps for scenarios not covered by existing playbooks, and document these as new/updated runbooks for L1 use.
Update and improve SOPs, playbooks, and knowledge base articles based on incident learnings.
4. L1 Oversight & Mentoring
Mentor and provide technical guidance to L1 analysts, including alert triage decisions and use of investigation tools.
Own L1 shift handovers, and train/mentor L1 analysts on alert handling and escalation.
Review quality of L1 alert closures and escalations; provide feedback and coaching.
Support training and onboarding of L1 analysts on tools, triage procedures, and escalation criteria.
Ensure smooth shift handovers between L1 and L2, and across shifts.
5. Compliance & Audit Support
Assist with compliance and audit requests requiring deeper technical evidence or investigation summaries.
6. Continuous Learning & Feedback
Continuously expand knowledge of emerging threats, attack techniques, and best practices through ongoing training and self-study.
Stay current on emerging threats, TTPs, and vulnerabilities relevant to our environment, and translate this into actionable detection improvements.

Skills:

• Strong working knowledge of SIEM query languages — direct experience with OpenSearch Query DSL, Lucene syntax, KQL, SPL, or equivalent is essential (you must be comfortable querying raw data without relying on prebuilt dashboards)
• Solid Linux investigation skills — process, network, and log-level analysis on Linux hosts is core to this role
• Practical understanding of cloud security fundamentals, ideally AWS (IAM, CloudTrail, VPC Flow Logs, GuardDuty, etc.)
• Exposure to Kubernetes/container security concepts (pod logs, k8s audit logs, common container attack patterns)
• Familiarity with Cloudflare logs (WAF, DNS, edge traffic) or similar CDN/edge security tooling
• Working knowledge of Microsoft Defender and basic Windows/macOS endpoint investigation
• Strong analytical and investigative mindset — able to pivot from a single alert to a full incident narrative using raw log data
• Understanding of the MITRE ATT&CK framework and common attack patterns (cloud, container, endpoint), including mapping detections for coverage visibility
• Experience acting as an escalation point for L1 analysts — validating their triage, coaching on quality, and owning shift handovers
• Ability to author and maintain runbooks, SOPs, and knowledge base articles from incident learnings
• Clear, structured incident documentation and communication skills

Experience and Qualifications:

• 3–5 years of hands-on SOC experience, with at least 1–2 years in an L2 analyst capacity handling escalations independently
• Bachelor of Technology (BE/B.Tech), M.Tech/ME in Computer Science or equivalent.
• Prior SOC experience in a fintech, banking, or regulated industry environment
• Exposure to Azure Sentinel/Azure logs in addition to AWS
• Scripting ability (Python, Bash) for automation of repetitive investigation tasks
• Certifications such as Security+, GCIH, GCIA, CySA+, or equivalent
• Experience contributing to detection engineering (writing/tuning correlation rules, not just consuming them)
• Familiarity with case management/ticketing tools (e.g., TheHive, Jira, ServiceNow)
• Experience developing or tuning UEBA rules
• Experience identifying and reporting log pipeline health issues (missing sources, parser errors, ingestion outages)
• Experience supporting compliance/audit evidence requests (PCI-DSS, SOC 2, RBI/regulatory — relevant to fintech)