L2/L3 Analyst – SOC / DFIR

Job Summary: We are seeking a skilled Security Analyst to perform log monitoring, forensic analysis, and threat intelligence activities to identify and mitigate unauthorized or suspicious activities across systems and networks. The role involves analyzing security events, identifying vulnerabilities, and supporting proactive cybersecurity measures within a 24x7 SOC environment. Key Responsibilities: Strong hands-on experience in raw log and network traffic analysis, including PCAPs, firewall logs, Windows/Linux Event logs, and security telemetry, to identify and investigate C2 traffic, suspicious communications, scanning activity, data exfiltration/transfer, and protocol- level anomalies. Perform Digital Forensics and Incident Response (DFIR) investigations for compromised endpoints, servers, accounts and network infrastructure. Conduct onsite client visits for security incident investigations, troubleshooting, and technical assessments, including onsite log collection and capture from firewalls, servers, endpoints, network devices, and other security infrastructure. Perform detailed log analysis and event correlation across Windows, Linux, Active Directory, firewall, VPN, DNS, proxy, endpoint and cloud environments. Investigate and triage escalated security incidents received from SOC L1 and determine severity, impact, scope and required response. Investigate firewall alerts including suspicious inbound/outbound traffic, port scans, malicious IPs, blocked connections, C2 communication and abnormal network activity. Perform advanced endpoint investigation using EDR/XDR telemetry, process trees, command lines, file activity, persistence and network connections. Conduct vulnerability assessment activities, analyse vulnerability scan results and coordinate remediation with infrastructure/application teams. Track critical and high-risk vulnerabilities, validate remediation status and escalate overdue vulnerabilities to appropriate stakeholders. Perform proactive threat hunting using SIEM, EDR, firewall, DNS, identity, vulnerability and threat-intelligence data. Design and maintain detection use cases mapped to MITRE ATT&CK tactics and techniques and continuously identify detection gaps. Lead investigation and response for P2/P3 incidents and provide technical support and escalation handling for P1/Critical incidents. Handle client escalations, provide technical analysis, incident updates, remediation recommendations and timely closure as per SLA. Participate in client meetings and client visits for security assessments, incident investigations, SOC reviews, technical discussions and security improvement activities. Coordinate with client Network, Infrastructure, IAM, Cloud, Application, VAPT and IT teams for incident containment and remediation. Conduct root-cause analysis, attack timeline reconstruction, impact assessment and prepare detailed RCA/post-incident reports. Develop, maintain and improve incident response playbooks, SOPs, investigation procedures and operational runbooks. Support security automation/SOAR activities for alert enrichment, investigation, ticket creation and response actions. Mentor L1/L2 analysts, review complex investigations, conduct technical knowledge-sharing sessions and improve SOC operational processes. Maintain accurate incident records, vulnerability reports, client escalations, investigation evidence in ticketing tool and contribute to SOC maturity and continuous improvement. Monitor, analyze and respond to security alerts across SIEM, EDR/XDR, firewall, IDS/IPS, email, network and cloud security platforms. Eligibility Criteria: 3–6+ years of experience for SOC L2/L3 roles, depending on the organization and role scope. Bachelor’s degree in computer science, Information Technology, Cybersecurity, Electronics, or a related technical discipline. SIEM/EDR-specific certifications such as Microsoft Security, Splunk, CrowdStrike, Sentinel One, Fortinet or equivalent vendor certifications are an advantage. Knowledge of MITRE ATT&CK, NIST Incident Response Framework Desirable: . Knowledge of MITRE ATT&CK, NIST Incident Response Framework Work Environment: Willingness to work in a 24x7 rotational shift environment . Travel Requirements: Travel may be required across locations for project execution, monitoring, and team coordination.