Senior Security Engineer (SOC L2)

Location: Hyderabad, India
Compensation: INR 1000000 - 1200000 per year

Junior L2 SOC Analyst is responsible for advanced alert investigation, incident validation, and supporting incident response activities within a 24x7 Security Operations Center (SOC). This role bridges L1 monitoring and L2 deep-dive analysis, focusing on improving detection accuracy, reducing false positives, and enhancing response effectiveness.

The analyst will work with Microsoft Azure Sentinel (SIEM), SentinelOne XDR, SOAR platforms, and threat intelligence feeds, and will gradually take ownership of deeper investigations, use-case tuning, and response coordination. The role also requires working knowledge of AI-driven SOC tools and analytics to improve detection and operational efficiency.

Roles and Responsibilities
Perform advanced triage and investigation of security alerts escalated from L1 analysts
Analyze and correlate logs across SIEM (Azure Sentinel), XDR (SentinelOne), network, identity, and cloud sources
Validate incidents, determine true positives vs false positives, and assign severity levels
Support incident response activities including containment, eradication, and recovery coordination
Execute and enhance SOC playbooks and SOAR automation workflows
Perform basic threat hunting based on hypotheses or IOC-driven analysis
Contribute to SIEM use-case tuning, rule optimization, and false positive reduction
Integrate and leverage threat intelligence feeds for enriched investigation and detection
Assist in Root Cause Analysis (RCA) and post-incident reporting
Ensure adherence to SLA timelines (MTTD, MTTR) and escalation procedures
Collaborate with L3/Threat Hunters for complex investigations and advanced threats
Support monitoring of cloud (AWS/Azure), endpoint, network, and identity security alerts
Document detailed incident findings, evidence, and response actions
Utilize or assist in implementing AI-driven SOC tools (e.g., Prophet AI, Harkx, or similar) for alert analysis, automation, and anomaly detection
Continuously improve knowledge of emerging threats, attacker techniques, and SOC best practices

Experience Required
2–4 years of experience in SOC / Security Operations
Minimum 1–2 years in L1 SOC role with hands-on alert triage and monitoring
Exposure to L2 activities such as investigation, correlation, or incident response support
Experience in MSSP or 24x7 SOC environment preferred

Strong foundation in SOC operations (L1 + basic L2 capabilities)
Hands-on experience with SIEM (Microsoft Azure Sentinel preferred)
Experience with EDR/XDR tools (SentinelOne or similar)
Awareness or hands-on exposure to AI-driven SOC tools / AI-based detection platforms
Good understanding of incident investigation and response lifecycle
Strong skills in log analysis, correlation, and alert validation
Knowledge of network, endpoint, cloud, and identity-based attack techniques
Familiarity with query languages (KQL or similar)
Experience working with threat intelligence and IOC analysis
Understanding of SOAR and automation workflows
Strong analytical thinking and problem-solving skills