Senior Security Operations Center Analyst - Threat Hunting

Role & Responsibilities : - Monitor and analyze security alerts from SIEM, EDR, XDR, IDS/IPS, firewalls, and other security monitoring tools. - Perform Level 2/Level 3 SOC operations including alert triage, investigation, containment, and escalation. - Conduct in-depth analysis of security incidents, suspicious activities, malware alerts, phishing attempts, and potential breaches. - Perform threat hunting activities using threat intelligence, MITRE ATT&CK techniques, and indicators of compromise (IOCs). - Investigate logs from various sources including endpoints, servers, network devices, cloud platforms, and applications. - Create detailed incident reports, root cause analysis (RCA), and recommendations for preventing future incidents. - Manage and respond to security incidents according to defined incident response processes and SLAs. - Correlate events across multiple security platforms to identify advanced threats and attack patterns. - Develop and improve detection rules, correlation searches, use cases, and security monitoring dashboards. - Tune SIEM alerts to reduce false positives and improve detection accuracy. - Perform malware analysis and suspicious file investigations when required. - Provide mentorship and technical guidance to junior SOC analysts. - Participate in 24x7 SOC operations and rotational shifts when required. Preferred Candidate Profile : - Bachelors degree in Computer Science, Information Security, Cybersecurity, or related field. - 5 to 10 years of experience in Security Operations Center (SOC) environments. - Strong experience handling L2/L3 security incidents and investigations. - Hands-on experience with SIEM platforms such as: 1. Splunk Enterprise Security 2. Microsoft Sentinel 3. IBM QRadar 4. ArcSight 5. LogRhythm - Experience with EDR/XDR solutions such as: 1. Microsoft Defender for Endpoint 2. CrowdStrike Falcon 3. SentinelOne 4. Palo Alto Cortex XDR - Strong understanding of: 1. Network security concepts (TCP/IP, DNS, HTTP/HTTPS, VPN, firewalls) 2. Windows and Linux operating systems 3. Active Directory security 4. Cloud security fundamentals (Azure/AWS/GCP) 5. Threat intelligence and IOC analysis 6. MITRE ATT&CK framework 7. Incident response lifecycle - Ability to perform: 1. Threat hunting 2. Log correlation 3. Malware investigation 4. Phishing analysis 5. Digital forensics basics - Knowledge of security frameworks and standards: 1. ISO 27001 2. NIST Cybersecurity Framework 3. CIS Controls 4. PCI-DSS (preferred) - Relevant certifications preferred: 1. CISSP 2. CISM 3. CEH 4. GIAC (GCIH/GCIA/GCFA) 5. OSCP 6. CompTIA Security+ 7. Splunk Certified Cybersecurity Analyst 8. Microsoft Security certifications