About the role
Key Responsibilities· Investigate and resolve incidents escalated by L1 analysts.· Perform threat hunting across endpoint, network, identity, and cloud logs.· Analyze indicators of compromise (IOCs), suspicious processes, malicious IPs, and unusual authentication activity.· Conduct incident scoping, root-cause analysis, and impact assessment.· Develop, tune, and test SIEM detection rules and correlation searches.· Create new detection use cases to address emerging threats and monitoring gaps.· Reduce false positives and improve alert quality.· Coordinate with infrastructure, network, endpoint, and identity teams during investigations.· Maintain incident reports, technical documentation, and response timelines.· Support security frameworks, compliance requirements, and SOC process improvements.· Mentor L1 analysts and improve triage and escalation procedures.
Must-Have Skills· Strong SIEM experience, preferably Splunk or another enterprise SIEM.· Threat hunting and advanced log analysis.· Incident investigation, containment coordination, and response.· Detection engineering and use-case development.· Knowledge of endpoint, network, identity, and cloud security events.· Incident reporting, root-cause analysis, and stakeholder communication.
Preferred CertificationsCISSP, CompTIA Security+, or other relevant cybersecurity certifications. Confirm which credentials are mandatory versus preferred.