Senior Security Analyst
Core
Lead L2/L3 security investigations, incident response, and detection engineering for a global SOC protecting cloud-native SaaS, edge IoT, and multi-cloud environments.
Role type
Senior Security Analyst (L2/L3 SOC)
Builds
AI-assisted triage pipelines, SOAR playbooks, and detection rules for AWS, Azure, SaaS, endpoints, and IoT fleets.
Domain
Cybersecurity, Cloud Security, AI Security, IoT Security
Deliverable
production ML models
Required skills
SIEM (Splunk, Wazuh, QRadar), EDR/XDR (CrowdStrike, Microsoft Defender), Cloud Security (AWS, Azure), Incident Response, Threat Hunting, MITRE ATT&CK, Scripting (Python, PowerShell, Bash), Networking, Forensics
Preferred skills
GCIH, GCIA, GCFA, CySA+, SOAR development, LLM/Agentic security workflows, Container/Kubernetes security, Digital Forensics, ISO 27001/42001 audit support
Technologies
Wazuh, Splunk, ELK, CrowdStrike, Microsoft Defender, Proofpoint, SOAR, Python, REST APIs, AWS, Azure, Azure OpenAI, LangGraph, AISPM
Responsibilities
Act as L2/L3 escalation point for alerts across SIEM, EDR, identity, email, SaaS, and cloud tools; Perform deep-dive investigations correlating logs, endpoint telemetry, network data, and threat intelligence; Lead security incidents through detection, containment, eradication, recovery, and post-incident review; Build, test, and tune detection rules and correlation logic mapped to MITRE ATT&CK; Design and improve SOAR playbooks for enrichment, triage, and response; Mentor and coach L1 analysts; Maintain runbooks, playbooks, escalation matrices, and SOPs; Track and improve SOC metrics such as MTTD, MTTR, SLA adherence, and false-positive rate.
Seniority
Senior, hands-on IC
