L2 SOC Analyst/Lead (Microsoft Sentinel)- Immediate Joiner

Key Responsibilities

• Lead daily SOC shift operations, overseeing Tier 1 analysts, monitoring security alerts, managing incident escalations, and ensuring timely resolution of security incidents within defined SLAs.

• Oversee security monitoring and incident investigations using Microsoft Sentinel SIEM, CrowdStrike Falcon EDR, and ITSM platforms, ensuring effective triage, investigation, and escalation of security threats.

• Lead Level 2 incident response activities, including threat analysis, containment, remediation, and root cause analysis (RCA), in accordance with established Cyber Incident Response (CIR) plans.

• Coordinate shift handovers, incident tracking, ticket prioritisation, and workload distribution to ensure operational continuity and effective communication between SOC shifts.

• Provide technical guidance and support to Tier 1 analysts, reviewing escalated incidents, validating investigation findings, and ensuring adherence to SOC procedures and escalation protocols.

• Prepare and review incident reports, shift handover summaries, and weekly and monthly security updates for technical teams, stakeholders, and management.

• Monitor Microsoft Entra ID and on-premises Active Directory for suspicious account activity, privilege abuse, MFA gaps, and risky sign-ins, coordinating appropriate investigation and remediation.

• Develop, maintain, and improve security policies, incident response playbooks, disaster recovery and business continuity plans, risk registers, and risk management frameworks.

• Create and fine-tune Microsoft Sentinel detection rules, KQL queries, automation scripts, and threat-hunting use cases to enhance threat detection and response capabilities.

Requirements

• Bachelor's degree in Cyber Security, Information Technology, or a related field.

• 4–5 years of experience in cyber security operations, including 3–4 years in a Tier 2 SOC, incident response, or security engineering role. Experience working with an MSSP-managed Tier 1 SOC is preferred.

• Hands-on experience with Microsoft Sentinel, including KQL queries, analytics rules, log source onboarding, and detection tuning.

• Experience with CrowdStrike Falcon EDR or comparable platforms, covering alert triage, IOC management, detection rules, and endpoint protection.

• Working knowledge of Fortinet FortiGate firewalls and network security monitoring across multi-site environments.

• Proven experience in incident response, threat containment, RCA, and executive-level incident reporting.

• Good understanding of NIST CSF, ISO 27001, vulnerability management, compliance audits, and user access reviews.