L2 Security Analyst

Caliberly; Dubai; On-site; AED 180,000 - 280,000; Full time

Job summary

Caliberly is seeking an L2 Security Analyst in Dubai to investigate, analyse and respond to security incidents across the organisation. The role emphasizes threat detection, incident response and security monitoring using Microsoft Sentinel, CrowdStrike and Defender for Endpoint.

Responsibilities include monitoring alerts, performing in-depth analysis, coordinating containment and remediation, and producing detailed incident reports for escalation to L3.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity or related discipline.
• 3–5 years of experience in SOC operations or cybersecurity.
• Minimum 2 years hands-on experience in security monitoring and incident investigation.
• Relevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ or equivalent are desirable.

Responsibilities

• Monitor and investigate security alerts escalated from L1 SOC analysts.
• Perform in-depth analysis of security events to identify threats and IOCs.
• Investigate complex security incidents and determine scope, impact and severity.
• Correlate security events across sources to identify attack patterns.
• Monitor and investigate incidents using Microsoft Sentinel and develop/optimise KQL queries.
• Analyse logs from endpoints, networks, cloud environments and Microsoft 365.
• Coordinate endpoint isolation, remediation and recovery activities.
• Prepare incident reports and escalate critical incidents to L3 or stakeholders.

Skills

Microsoft Sentinel

CrowdStrike Falcon

Defender for Endpoint

KQL

SIEM/EDR/XDR

MITRE ATT&CK

Windows OS

Active Directory

Network basics

Education

Bachelor’s degree in CS/InfoSec

Job description

Job Title -L2 Security Analyst

JOB DESCRIPTION

The L2 Security Analyst will be responsible for investigating, analysing and responding to securityincidents across the organisation's security environment. The role requires hands-on experience with Microsoft Sentinel, CrowdStrike and Microsoft Defender, with a strong focus on threat detection,incident response and security monitoring.

Key Responsibilities

1. Security Monitoring & Incident Investigation

• Monitor and investigate security alerts escalated from L1 SOC analysts.
• Perform in-depth analysis of security events to identify potential threats, suspicious activitiesand indicators of compromise (IOCs).
• Investigate complex security incidents and determine their scope, impact and severity.
• Correlate security events across multiple sources to identify attack patterns.

2. SIEM – Microsoft Sentinel

• Monitor and investigate security incidents using Microsoft Sentinel.
• Develop, modify and optimise KQL queries for threat hunting and incident investigation.
• Analyse logs and security events from endpoints, networks, cloud environments andMicrosoft 365.
• Support the development and tuning of analytics rules, workbooks and detection use cases.

3. Endpoint Security – CrowdStrike & Microsoft Defender

• Monitor and investigate endpoint security alerts using CrowdStrike Falcon.
• Perform endpoint threat analysis, malware investigation and suspicious process analysis.
• Utilise Microsoft Defender for Endpoint to investigate threats, assess endpoint exposure andsupport incident containment.
• Coordinate endpoint isolation, remediation and recovery activities.
• Identify recurring endpoint threats and recommend preventive security measures.

4. Threat Hunting & Incident Response

• Conduct proactive threat hunting to identify hidden or emerging threats.
• Analyse IOCs, TTPs and attack patterns using MITRE ATT&CK.
• Support incident containment, eradication and recovery.
• Prepare detailed incident reports and recommend corrective actions.

5. Reporting & Escalation

• Prepare incident investigation reports and maintain accurate case documentation.
• Escalate critical security incidents to L3 or relevant stakeholders.
• Support L1 analysts through technical guidance and knowledge sharing.
• Contribute to continuous improvement of SOC processes and detection capabilities.

Required Technical Skills

• Hands-on experience with Microsoft Sentinel (SIEM).
• Strong practical experience with CrowdStrike Falcon (EDR).
• Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.
• Proficiency in KQL for security investigation and threat hunting.
• Strong understanding of SIEM, EDR, XDR and SOC operations.
• Knowledge of incident response, malware analysis and endpoint investigation.
• Familiarity with MITRE ATT&CK framework and threat intelligence.
• Understanding of Windows operating systems, Active Directory and network securityfundamentals.

Qualifications & Experience

• Bachelor's degree in Computer Science, Information Security, Cybersecurity or a relateddiscipline.
• 3–5 years of experience in SOC operations or cybersecurity.
• Minimum 2 years of hands-on experience in security monitoring and incident investigation.
• Relevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ orequivalent are desirable.

Key Competencies

• Strong analytical and problem-solving skills.
• Ability to investigate and prioritise security incidents independently.
• Good communication and technical reporting skills.
• Ability to work in a 24/7 SOC shift environment, where required.
• Strong attention to detail and ownership of incident resolution.

Required Technical Skills

• Hands-on experience with Microsoft Sentinel (SIEM).
• Strong practical experience with CrowdStrike Falcon (EDR).
• Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.
• Proficiency in KQL for security investigation and threat hunting.
• Strong understanding of SIEM, EDR, XDR and SOC operations.
• Knowledge of incident response, malware analysis and endpoint investigation.
• Familiarity with MITRE ATT&CK framework and threat intelligence.
• Understanding of Windows operating systems, Active Directory and network securityfundamentals.

Qualifications & Experience

• Bachelor's degree in computer science, Information Security, Cybersecurity or a relateddiscipline.
• 5+ years of experience in SOC operations or cybersecurity.
• Minimum 2 years of hands-on experience in security monitoring and incident investigation.
• Relevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ orequivalent are desirable.