Senior SOC Analyst / SOC Engineer (L3)

We are seeking an experienced L3 Senior SOC Analyst/SOC Engineer to support the delivery of 24/7 Managed Detection and Response (MDR) services.

The successful candidate will be responsible for advanced threat analysis, threat hunting, detection engineering, security automation, and root cause analysis. You will also provide technical guidance to L1 and L2 SOC analysts and contribute to the continuous improvement of the organization's SOC capabilities.

Key Responsibilities

• Conduct proactive threat hunting and advanced analysis of cybersecurity incidents.
• Lead investigations into complex threats and incidents escalated by L1 and L2 SOC analysts.
• Perform root cause analysis for major security incidents and recommend corrective and preventive actions.
• Create, test, tune, and maintain detection rules using Kusto Query Language (KQL).
• Develop and improve security analytics use cases within Microsoft Sentinel.
• Monitor and enhance threat detection capabilities using Microsoft Sentinel and Defender XDR.
• Maintain threat intelligence integrations and incorporate relevant intelligence into detection processes.
• Review and tune alerts to reduce false positives and improve detection accuracy.
• Develop Microsoft Sentinel automation playbooks using Azure Logic Apps.
• Automate appropriate incident response and containment actions.
• Develop and maintain investigation runbooks and response procedures for different incident types.
• Support the development and execution of the SOC threat-hunting program.
• Participate in cybersecurity simulation exercises and SOC maturity improvement initiatives.
• Maintain accurate investigation records, incident documentation, and audit trails.
• Provide technical guidance, coaching, and mentorship to L1 and L2 SOC Analysts.

Job Requirements

• Five to eight years of relevant experience in SOC operations, cybersecurity analysis, security engineering, or a related field.
• Strong hands-on experience with Microsoft Sentinel as a Security Information and Event Management (SIEM) platform.
• Strong working knowledge of Microsoft Defender XDR.
• Proficiency in Kusto Query Language (KQL) for threat hunting, investigations, and detection-rule development.
• Strong experience in advanced threat hunting and security incident analysis.
• Experience in detection engineering, security automation, and incident-response playbook development.
• Basic to intermediate knowledge of malware analysis.
• Strong analytical, investigative, and problem-solving abilities.
• Ability to independently manage complex security investigations and escalated incidents.
• Good communication skills, with the ability to clearly explain technical findings.
• Ability to guide and mentor junior SOC analysts.

SOC Operations and Working Arrangement

• The SOC operates 24/7 through three eight-hour shifts: morning, evening, and night.
• This L3 position primarily supports day operations during normal business hours.
• The successful candidate will be required to participate in an on-call roster and provide technical escalation support across all three shifts when necessary.
• Flexibility to support critical incidents outside normal working hours, including weekends and public holidays, may be required.

Preferred Certifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• Microsoft Certified: Cybersecurity Architect Expert (SC-100).
• Other relevant cybersecurity certifications will be an added advantage.

If you are an experienced cybersecurity professional who enjoys investigating complex threats, developing detection capabilities, improving security operations, and mentoring junior analysts, we welcome you to apply.