SOC Analyst L2/L3
Job Description
SOC Analyst – L2/L3
CrowdStrike EDR & Next-Gen SIEM
We are looking for an experienced SOC Analyst – L2/L3 to support 24x7 Security Operations. The role will be responsible for advanced security monitoring, incident investigation and response, threat hunting, detection engineering, and technical escalation.
The ideal candidate should have strong hands-on experience with CrowdStrike Falcon EDR and CrowdStrike Next-Gen SIEM, with the ability to independently investigate complex security incidents, analyze security telemetry, identify attacker behavior, and guide junior SOC analysts.
Key Responsibilities
Security Monitoring & Incident Response
- Act as the L2/L3 escalation point for complex and high-severity security incidents.
- Perform advanced triage, investigation, containment, and remediation of security incidents.
- Investigate malware, ransomware, phishing, credential compromise, suspicious authentication, privilege escalation, persistence, lateral movement, and suspected data exfiltration.
- Correlate endpoint, identity, network, cloud, email, and other security telemetry during investigations.
- Perform root-cause analysis and recommend corrective and preventive actions.
- Coordinate containment, remediation, and recovery activities with infrastructure, identity, network, cloud, and security teams.
- Maintain clear incident timelines, investigation findings, evidence, and remediation recommendations.
Required Skills & Experience
- 4–8 years of SOC/cybersecurity experience, with practical security monitoring and incident-response experience.
- Strong hands-on experience with CrowdStrike Falcon EDR.
- Hands-on experience with CrowdStrike Next-Gen SIEM.
- Strong knowledge of security incident investigation, triage, containment, and response.
- Experience with SIEM monitoring, event correlation, log analysis, and detection tuning.
- Practical experience with threat hunting, IOC analysis, and detection engineering.
- Strong understanding of endpoint telemetry and attacker behavior.
- Good working knowledge of MITRE ATT&CK and Cyber Kill Chain.
- Experience investigating Windows/Linux endpoints, Active Directory/identity, authentication, network, and cloud-related events.
- Good understanding of TCP/IP, DNS, HTTP/S, SMTP, SMB, firewalls, proxies, VPNs, and common security telemetry.
- Ability to independently investigate and manage high-severity security incidents.
- Strong analytical, troubleshooting, documentation, and communication skills.
- Willingness to work in a 24x7 SOC environment, including rotational shifts as required.
CrowdStrike Certification Requirement
- Relevant CrowdStrike certification is preferred at the time of joining.
- Candidates who are not CrowdStrike certified must be willing to obtain the applicable CrowdStrike Next-Gen SIEM certification within 3 months of joining.
- Candidates are expected to maintain hands-on proficiency with CrowdStrike Falcon EDR and CrowdStrike Next-Gen SIEM as part of the L2/L3 SOC role.
Source: the employer's careers page. Last checked 2026-10-26. Posted 2026-10-10.
More jobs at Wipro · Jobs in Bengaluru · On-site jobs in India