Associate Senior Security Analyst L2

Role Overview
The Associate Senior Security Analyst L2 is responsible for monitoring, investigating, and responding to security incidents across enterprise environments. The role involves advanced incident analysis, threat detection, SIEM/EDR monitoring, detection engineering, and escalation of complex security incidents to specialized teams.
Key Responsibilities

• Monitor and investigate security alerts and incidents using SIEM and EDR platforms.
• Perform L2-level triage, investigation, correlation, and root-cause analysis of security events.
• Analyze alerts related to identity, endpoint, network, cloud, email, and Microsoft 365 environments.
• Leverage AI/ML-powered security capabilities to enhance threat detection, alert correlation, incident investigation, threat hunting, and security automation, while validating AI-generated insights before taking remediation actions.
• Develop, tune, and maintain SIEM detection rules and use cases.
• Perform threat hunting and identify indicators of compromise (IOCs), suspicious behavior, and attack patterns.
• Investigate phishing, malware, credential compromise, brute-force, privilege escalation, lateral movement, and data-exfiltration incidents.
• Monitor and investigate endpoint threats using SentinelOne, Microsoft Defender, F-Secure, or similar EDR solutions.
• Analyze Windows, Linux, firewall, VPN, Active Directory/Entra ID, cloud, and network security logs.
• Perform incident containment and coordinate remediation activities with infrastructure, IAM, endpoint, and network teams.
• Escalate complex or high-severity incidents to L3/Threat Hunting/Incident Response teams with detailed investigation findings.
• Participate in SIEM onboarding, log-source integration, parser validation, and troubleshooting.
• Develop and optimize detection rules, dashboards, alerts, and security monitoring use cases.
• Support security automation and SOAR playbook development.
• Prepare incident reports, investigation summaries, and client-facing security reports.
• Participate in weekly/monthly security reviews and communicate security findings to stakeholders.
• Maintain SOC documentation, incident timelines, investigation procedures, and knowledge-base articles.
• Follow SOC processes, SLA requirements, escalation procedures, and security best practices.

Required Skills

• 3 to 4+ years of experience in SOC/Security Operations.
• Strong knowledge of SIEM, EDR, incident response, threat detection, and threat hunting.
• Hands on experience with Google SecOps, Microsoft Sentinel, QRadar, Splunk, LogRhythm, Wazuh, and other SIEM platforms.
• Experience with SentinelOne, Microsoft Defender, F-Secure, or similar EDR solutions.
• Strong understanding of MITRE ATT&CK, IOC analysis, Windows security events, Active Directory/Entra ID, networking, and cloud security.
• Experience creating and tuning SIEM detection rules and use cases.
• Knowledge of Azure/GCP/Microsoft 365 and cloud security monitoring.
• Basic scripting/automation knowledge using Python or PowerShell.
• Strong analytical, troubleshooting, documentation, and communication skills.

Preferred Certifications

• CompTIA CySA+
• Security+
• CEH
• SC-200
• CISSP
• Google SecOps certifications or any SIEM platform certifications