SOC L3 Engineer

Key Responsibilities

Security Operations & Incident Response

 Manage SOC team including L1, L2

 Monitor and investigate security alerts escalated by SOC L1, L2 analysts.

 Perform advanced alert triage, incident investigation, validation, and response.

 Analyse security events and logs from SIEM, EDR/XDR, firewalls, IDS/IPS, email security, and other security technologies.

 Investigate security incidents including malware, phishing, brute-force attacks, suspicious authentication, privilege escalation, lateral movement, and data exfiltration.

 Perform threat hunting activities using threat intelligence, endpoint telemetry, network data, and SIEM queries.

 Identify and analyse Indicators of Compromise (IOCs), including malicious IPs, domains, URLs, file hashes, and suspicious processes.

 Support incident containment, eradication, remediation, and recovery activities.

 Conduct root-cause analysis and prepare detailed incident investigation reports.

 Ensure incidents are handled within defined SLAs and escalation procedures.

 Coordinate with customers and internal IT/security teams during security incidents.

Required Technical Skills

 Strong understanding of SOC operations and security incident management.

 Hands-on experience with SIEM platforms such as Splunk, IBM QRadar, or similar.

 Experience with EDR/XDR platforms such as CrowdStrike Falcon, Microsoft Defender, SentinelOne, ELK or similar.

 Strong knowledge of Windows and Linux security.

 Good understanding of TCP/IP, DNS, HTTP/HTTPS, VPN, firewalls, IDS/IPS, and network security.

 Experience in threat intelligence, IOC analysis, and threat hunting.

 Good understanding of the MITRE ATT&CK framework and common attack techniques.

 Knowledge of incident response and basic digital forensics.

 Experience with SIEM query languages.

 Understanding of vulnerability management and remediation processes.

 Exposure to cloud security concepts across Azure, AWS, or GCP is an advantage.

 Experience working in an MSSP or multi-customer SOC environment is highly desirable.