L3 Threat Analyst/Incident Response Lead

Role Overview

The L3 Threat Analyst leads complex incident response and advanced threat investigations , owning incidents end-to-end while guiding L1/L2 analysts. This role combines deep technical expertise, adversary understanding, and detection engineering to strengthen the organization’s overall security posture.

Key Responsibilities

Advanced Incident Response Leadership

• Lead high-severity and complex incidents (multi-stage attacks, APTs, lateral movement, data exfiltration)
• Own end-to-end response: detection → investigation → containment → eradication → recovery
• Act as the technical decision-maker during active incidents

Deep Threat Investigation

• Perform advanced analysis across:
• Endpoint telemetry, memory artifacts, disk forensics
• Network traffic (PCAP, NDR)
• Identity and cloud logs
• Reconstruct full attack chains and identify root cause + blast radius
• Handle fileless malware, living-off-the-land (LotL), and stealthy persistence techniques

Threat Hunting & Adversary Emulation

• Design and lead proactive threat hunting campaigns
• Simulate attacker techniques (red/purple mindset) to validate detection coverage
• Identify gaps and convert them into high-fidelity detections

Detection Engineering

• Design, build, and optimize advanced detection logic
• Develop detections across:
• SIEM (correlation rules, anomaly detection)
• EDR/NDR analytics
• Ensure coverage across the MITRE ATT&CK framework
• Mentor L1/L2 on detection quality and tuning

Forensics & Malware Analysis

• Conduct host and network forensics
• Perform static and basic dynamic malware analysis
• Extract IOCs, behaviors, and detection patterns

Automation & SOC Engineering Collaboration

• Define and drive automation strategy (SOAR, pipelines)
• Collaborate with engineering teams to:
• Improve telemetry pipelines
• Optimize data ingestion and correlation
• Scale detection systems for high EPS environments

Incident Command & Stakeholder Management

• Act as Incident Commander for critical incidents
• Provide clear, structured communication to leadership
• Lead post-incident reviews and drive corrective actions

SOC Maturity & Strategy

• Define and improve:
• IR playbooks
• Detection coverage roadmap
• SOC metrics (MTTD, MTTR, detection fidelity)
• Continuously enhance SOC capabilities and resilience

Required Skills & Qualifications

• 5+ years of experience in Incident Response / Threat Hunting / SOC Engineering
• Strong expertise in:
• Advanced attack techniques (APT, lateral movement, persistence)
• MITRE ATT&CK mapping and adversary behavior analysis
• Windows & Linux internals
• Hands-on experience with:
• SIEM (Splunk, ELK, Sentinel, etc.)
• EDR/NDR platforms
• Log correlation in large-scale distributed systems
• Deep knowledge of:
• Networking (packet-level understanding, DNS abuse, C2 patterns)
• Identity attacks (Kerberos, AD abuse, credential theft)
• Strong scripting/programming skills (Python, PowerShell, Bash)

Good to Have

• Experience in high-throughput environments (100K+ EPS, data lakes)
• Detection engineering frameworks (Sigma, YARA, KQL, SPL)
• Cloud security and container environments
• Reverse engineering (intermediate level)
• Experience in SOAR and automation design

Key Traits

• Thinks like an attacker, acts like a defender
• Strong ownership and decision-making under pressure
• Systems-level thinking (not just alerts, but pipelines and architecture)
• Mentorship mindset for L1/L2 analysts

Required Skills

threat MITRE ATT&CK