L2 Security Analyst

Job Title -L2 Security Analyst

JOB DESCRIPTION

The L2 Security Analyst will be responsible for investigating analysing and responding to securityincidents across the organisations security environment. The role requires hands-on experience withMicrosoft Sentinel CrowdStrike and Microsoft Defender with a strong focus on threat detectionincident response and security monitoring.

Key Responsibilities

1. Security Monitoring & Incident Investigation

Monitor and investigate security alerts escalated from L1 SOC analysts.

Perform in-depth analysis of security events to identify potential threats suspicious activitiesand indicators of compromise (IOCs).

Investigate complex security incidents and determine their scope impact and severity.

Correlate security events across multiple sources to identify attack patterns.

2. SIEM Microsoft Sentinel

Monitor and investigate security incidents using Microsoft Sentinel.

Develop modify and optimise KQL queries for threat hunting and incident investigation.

Analyse logs and security events from endpoints networks cloud environments andMicrosoft 365.

Support the development and tuning of analytics rules workbooks and detection use cases.

3. Endpoint Security CrowdStrike & Microsoft Defender

Monitor and investigate endpoint security alerts using CrowdStrike Falcon.

Perform endpoint threat analysis malware investigation and suspicious process analysis.

Utilise Microsoft Defender for Endpoint to investigate threats assess endpoint exposure andsupport incident containment.

Coordinate endpoint isolation remediation and recovery activities.

Identify recurring endpoint threats and recommend preventive security measures.

4. Threat Hunting & Incident Response

Conduct proactive threat hunting to identify hidden or emerging threats.

Analyse IOCs TTPs and attack patterns using MITRE ATT&CK.

Support incident containment eradication and recovery.

Prepare detailed incident reports and recommend corrective actions.

5. Reporting & Escalation

Prepare incident investigation reports and maintain accurate case documentation.

Escalate critical security incidents to L3 or relevant stakeholders.

Support L1 analysts through technical guidance and knowledge sharing.

Contribute to continuous improvement of SOC processes and detection capabilities.

Required Technical Skills

Hands-on experience with Microsoft Sentinel (SIEM).

Strong practical experience with CrowdStrike Falcon (EDR).

Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.

Proficiency in KQL for security investigation and threat hunting.

Strong understanding of SIEM EDR XDR and SOC operations.

Knowledge of incident response malware analysis and endpoint investigation.

Familiarity with MITRE ATT&CK framework and threat intelligence.

Understanding of Windows operating systems Active Directory and network securityfundamentals.

Qualifications & Experience

Bachelors degree in Computer Science Information Security Cybersecurity or a relateddiscipline.

35 years of experience in SOC operations or cybersecurity.

Minimum 2 years of hands-on experience in security monitoring and incident investigation.

Relevant certifications such as SC-200 AZ-500 CrowdStrike certifications Security orequivalent are desirable.

Key Competencies

Strong analytical and problem-solving skills.

Ability to investigate and prioritise security incidents independently.

Good communication and technical reporting skills.

Ability to work in a 24/7 SOC shift environment where required.

Strong attention to detail and ownership of incident resolution.

Required Technical Skills

Hands-on experience with Microsoft Sentinel (SIEM).

Strong practical experience with CrowdStrike Falcon (EDR).

Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.

Proficiency in KQL for security investigation and threat hunting.

Strong understanding of SIEM EDR XDR and SOC operations.

Knowledge of incident response malware analysis and endpoint investigation.

Familiarity with MITRE ATT&CK framework and threat intelligence.

Understanding of Windows operating systems Active Directory and network securityfundamentals.

Qualifications & Experience

Bachelors degree in computer science Information Security Cybersecurity or a relateddiscipline.

5 years of experience in SOC operations or cybersecurity.

Minimum 2 years of hands-on experience in security monitoring and incident investigation.

Relevant certifications such as SC-200 AZ-500 CrowdStrike certifications Security orequivalent are desirable.

Apply now!