L2 Security Analyst

Job Title -L2 Security Analyst

JOB DESCRIPTION

The L2 Security Analyst will be responsible for investigating, analysing and responding to securityincidents across the organisation's security environment. The role requires hands-on experience with Microsoft Sentinel, CrowdStrike and Microsoft Defender, with a strong focus on threat detection,incident response and security monitoring.

Key Responsibilities

1. Security Monitoring & Incident Investigation

• Monitor and investigate security alerts escalated from L1 SOC analysts.
• Perform in-depth analysis of security events to identify potential threats, suspicious activitiesand indicators of compromise (IOCs).
• Investigate complex security incidents and determine their scope, impact and severity.
• Correlate security events across multiple sources to identify attack patterns.

2. SIEM – Microsoft Sentinel

• Monitor and investigate security incidents using Microsoft Sentinel.
• Develop, modify and optimise KQL queries for threat hunting and incident investigation.
• Analyse logs and security events from endpoints, networks, cloud environments andMicrosoft 365.
• Support the development and tuning of analytics rules, workbooks and detection use cases.

3. Endpoint Security – CrowdStrike & Microsoft Defender

• Monitor and investigate endpoint security alerts using CrowdStrike Falcon.
• Perform endpoint threat analysis, malware investigation and suspicious process analysis.
• Utilise Microsoft Defender for Endpoint to investigate threats, assess endpoint exposure andsupport incident containment.
• Coordinate endpoint isolation, remediation and recovery activities.
• Identify recurring endpoint threats and recommend preventive security measures.

4. Threat Hunting & Incident Response

• Conduct proactive threat hunting to identify hidden or emerging threats.
• Analyse IOCs, TTPs and attack patterns using MITRE ATT&CK.
• Support incident containment, eradication and recovery.
• Prepare detailed incident reports and recommend corrective actions.

5. Reporting & Escalation

• Prepare incident investigation reports and maintain accurate case documentation.
• Escalate critical security incidents to L3 or relevant stakeholders.
• Support L1 analysts through technical guidance and knowledge sharing.
• Contribute to continuous improvement of SOC processes and detection capabilities.

Required Technical Skills

• Hands-on experience with Microsoft Sentinel (SIEM).
• Strong practical experience with CrowdStrike Falcon (EDR).
• Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.
• Proficiency in KQL for security investigation and threat hunting.
• Strong understanding of SIEM, EDR, XDR and SOC operations.
• Knowledge of incident response, malware analysis and endpoint investigation.
• Familiarity with MITRE ATT&CK framework and threat intelligence.
• Understanding of Windows operating systems, Active Directory and network securityfundamentals.

Qualifications & Experience

• Bachelor's degree in Computer Science, Information Security, Cybersecurity or a relateddiscipline.
• 3–5 years of experience in SOC operations or cybersecurity.
• Minimum 2 years of hands-on experience in security monitoring and incident investigation.
• Relevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ orequivalent are desirable.

Key Competencies

• Strong analytical and problem-solving skills.
• Ability to investigate and prioritise security incidents independently.
• Good communication and technical reporting skills.
• Ability to work in a 24/7 SOC shift environment, where required.
• Strong attention to detail and ownership of incident resolution.

Required Technical Skills

• Hands-on experience with Microsoft Sentinel (SIEM).
• Strong practical experience with CrowdStrike Falcon (EDR).
• Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.
• Proficiency in KQL for security investigation and threat hunting.
• Strong understanding of SIEM, EDR, XDR and SOC operations.
• Knowledge of incident response, malware analysis and endpoint investigation.
• Familiarity with MITRE ATT&CK framework and threat intelligence.
• Understanding of Windows operating systems, Active Directory and network securityfundamentals.

Qualifications & Experience

• Bachelor's degree in computer science, Information Security, Cybersecurity or a relateddiscipline.
• 5+ years of experience in SOC operatio