TECHNICAL LEAD - SOC Monitoring

Job description

Job Description - -------------- **Job Description SOC Incident Response Threat Intelligence / Threat Hunting (L3)** **Position Title** **L3 Security Analyst SOC Incident Response, Threat Intelligence \& Threat Hunting** **Experience** 610 years in Cyber Security Operations, Incident Response, Threat Intelligence, and Threat Hunting **Location** Flexible / Hybrid / Onsite **Role Summary** We are looking for an experienced L3 SOC Security Analyst with strong expertise in Incident Response (IR), Threat Intelligence (TI), and proactive Threat Hunting. The candidate will act as a senior escalation point for high-severity security incidents, conduct advanced investigations, develop threat hunting hypotheses, and provide actionable intelligence to improve the organizations overall security posture. The role requires hands-on expertise across SIEM, EDR/XDR, network security monitoring, malware analysis, threat intelligence platforms, and cloud security monitoring. **Key Responsibilities** **Incident Response \& Security Operations** * Lead investigation and response activities for complex security incidents including: * Ransomware * Advanced Persistent Threats (APT) * Insider threats * Credential compromise * Web application attacks * Cloud security incidents * Data exfiltration * Lateral movement * Privilege escalation * Perform advanced triage and root cause analysis using: * SIEM * EDR/XDR * Network telemetry * Threat intelligence feeds * Cloud logs * Endpoint forensics * Handle L3 escalations from L1/L2 SOC analysts. * Conduct incident containment, eradication, and recovery coordination. * Develop and improve: * Incident response playbooks * Detection use cases * Correlation rules * SOC runbooks * Automation workflows * Coordinate with infrastructure, cloud, application, and business teams during major incidents. * Prepare executive and technical incident reports with actionable recommendations. **Threat Intelligence Responsibilities** * Monitor and analyze cyber threat intelligence from: * Commercial TI platforms * Open-source intelligence (OSINT) * Government/CERT advisories * Dark web monitoring * Vendor threat reports * Enrich alerts with Indicators of Compromise (IOCs), TTPs, malware intelligence, and adversary attribution. * Map adversary activities to: * MITRE ATT\&CK * Cyber Kill Chain * Diamond Model * Analyze emerging threats, zero-days, ransomware campaigns, and targeted attack trends. * Provide strategic and operational threat advisories to SOC and leadership teams. * Create threat intelligence reports, executive summaries, and threat landscape assessments. **Threat Hunting Responsibilities** * Conduct proactive threat hunting using hypothesis-driven methodologies. * Hunt for: * Persistence mechanisms * Beaconing activity * Credential dumping * Living-off-the-land (LOLBins) * Command \& Control (C2) * Suspicious PowerShell activity * Lateral movement * Cloud anomalies * Use telemetry from: * SIEM * EDR/XDR * DNS * Proxy * Firewall * Identity systems * Cloud platforms * Develop custom queries and analytics for detecting stealthy attacker behavior. * Identify detection gaps and recommend logging improvements. * Convert hunt findings into production-grade detection use cases. **Required Technical Skills** **SIEM \& Security Monitoring** Strong hands-on experience with one or more: * IBM QRadar * Microsoft Sentinel * Splunk Enterprise Security * ArcSight * LogRhythm **EDR/XDR Technologies** Experience with: * CrowdStrike Falcon * Microsoft Defender for Endpoint * SentinelOne * Palo Alto Cortex XDR **Threat Intelligence Platforms** Experience with: * Recorded Future * Anomali ThreatStream * MISP * ThreatConnect **Cloud \& Infrastructure Security** Knowledge of: * Amazon Web Services security monitoring * Microsoft Azure security services * Google Cloud Platform logging and detections * Identity security and IAM monitoring * Container/Kubernetes security basics **Investigation \& Analysis Skills** * Malware triage and behavioural analysis * Windows/Linux forensic analysis * Memory and disk artifact analysis * Packet analysis using Wireshark * Threat actor TTP analysis * IOC enrichment and validation **Scripting \& Automation** Good knowledge of: * Python * PowerShell * KQL * SPL * Regex * API integrations * SOAR automation **Desired Certifications** Preferred certifications include: * GIAC Certified Incident Handler (GCIH) * GIAC Certified Forensic Analyst (GCFA) * GIAC Certified Intrusion Analyst (GCIA) * Certified Threat Intelligence Analyst (CTIA) * EC-Council Certified Ethical Hacker (CEH) * ISC2 CISSP * Security vendor certifications **Key Competencies** * Strong analytical and investigative mindset * Excellent communication and stakeholder management * Ability to work during high-pressure incidents * Deep understanding of attacker methodologies * Strong documentation and reporting capability * Mentoring and guidance for junior analysts * Ability to independently lead investigations **Preferred Exposure** * MDR/MSSP environment * Healthcare / BFSI / Critical infrastructure domains * Threat hunting frameworks * Purple team exercises * MITRE ATT\&CK-based detection engineering * SOAR platforms and automation * Cloud-native SOC operations **Typical Deliverables** * Incident investigation reports / RCA * Threat intelligence advisories * Hunting reports and findings * Detection use cases * IOC/TTP repositories / MITRE * Executive risk summaries * Threat landscape assessments * SOC maturity improvement recommendations * Presentation skills * Communication skills