Cybersecurity Analyst II

Avnet; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Avnet is seeking a Security Analyst II to join its 24/7 Security Operations Centre. You will investigate and respond to complex security events, provide on-shift escalation support for junior analysts, and collaborate with cross-functional teams to contain, remediate, and recover from incidents.

You will monitor alerts across EDR, NDR, and SIEM, document findings, and contribute to process improvements while staying current with evolving threats and best practices.

Qualifications

• 3+ years of experience in security operations, incident response, threat detection, or a similar cybersecurity function.
• Experience in a 24x7 or shift-based Security Operations Centre environment is strongly preferred.
• Experience working with globally distributed teams across cultures and time zones.
• Intermediate cybersecurity certifications such as AZ-500, CySA+, GSOC, or GCIA are an added advantage.

Responsibilities

• Respond to security events in a 24x7 SOC environment and maintain visibility of the active alert queue.
• Lead investigations and response for high-impact or complex incidents and assess scope and business impact.
• Investigate alerts from security tools (EDR, NDR, SIEM) and develop timelines and hypotheses.
• Act as on-shift technical escalation for junior analysts and guide investigative steps.
• Provide structured handovers between shifts and own investigations through resolution or formal handover.
• Contribute to security documentation, playbooks, and incident response plans and identify detection gaps.
• Stay current with threats and participate in training to enhance skills and knowledge.

Skills

Analytical skills

Incident response

Security monitoring

Communication

Education

Bachelor's degree in Cybersecurity

Bachelor's degree in Computer Science

Bachelor's degree in Information Technology

Tools

AZ-500

CySA+

GSOC

GCIA

Job description

Overview

The Security Analyst II is responsible for investigating and responding to complex, escalated, or high-impact cybersecurity events within a 24/7 Security Operations Centre (SOC). The role involves analysing security activity across multiple technology domains, correlating available evidence, determining the scope and potential impact of incidents, and supporting appropriate response and remediation actions.

In addition to managing assigned investigations, the Security Analyst II serves as an on-shift technical escalation point for Security Analyst I, providing guidance on complex cases and supporting timely decision-making. The role requires strong investigative judgement across areas such as phishing, account compromise, malware, and potential data exposure, while ensuring investigations are properly documented, progressed, and handed over between operational shifts.

The position operates within a 24/7 Security Operations Centre, and candidates should be comfortable working rotational shifts, including nights, weekends, and public holidays.

Principal Responsibilities

Monitoring and Analysis

• Support a 24x7 Global Security Operations Centre (SOC) environment by responding to security events in the environment.
• Maintain visibility across the active alert queue and support timely investigation and resolution of security events.

Incident Triage and Response

• Lead the investigation and response of higher-impact or complex security incidents.
• Assess the scope, severity, and potential business impact of suspicious activity.
• Recommend and coordinate appropriate containment, remediation, and escalation actions in accordance with established procedures.
• Collaborate with incident response and relevant internal teams to support effective incident handling.

Alert Investigation

• Investigate and analyse alerts generated by security tools (EDR, NDR, SIEM) to identify potential security incidents.
• Correlate available evidence to develop investigation hypotheses, construct timelines, and identify potentially affected users or systems.
• Document investigation findings and provide detailed reports.

Technical Escalation and Analyst Support

• Serve as an on-shift technical escalation point for junior analysts handling complex or unfamiliar security events.
• Review escalated investigations for completeness and accuracy and provide guidance on additional investigative steps.
• Communicate technical findings, security risks, and required actions clearly to relevant stakeholders.
• Support the coordination of evidence gathering, containment, remediation, and recovery activities.

Shift Handover and Collaboration

• Provide structured handovers of ongoing investigations between Security Operations Centre shifts.
• Review and accept cases transferred from previous shifts.
• Maintain appropriate ownership of investigations until resolution, escalation, or formal handover.

Security Documentation and Process Improvement

• Contribute to the development and maintenance of security documentation, procedures, playbooks, and incident response plans.
• Identify recurring false positives, detection gaps, and operational inefficiencies.
• Recommend improvements to security monitoring, investigation, and escalation processes.

Continuous Learning

• Stay current with emerging threats, vulnerabilities, and industry best practices.
• Participate in training and development programmes to enhance skills and knowledge.

Work Experience

• 3+ years of relevant experience in security operations, incident response, threat detection, or a comparable cybersecurity function.
• Demonstrated experience independently investigating security incidents, handling escalations, and supporting incident response activities.
• Prior experience working in a 24x7 or shift-based Security Operations Centre environment is strongly preferred.
• Equivalent practical experience may be considered where the required technical and investigative capability is clearly demonstrated.
• Experience working within globally distributed teams and collaborating effectively across cultures, regions, functions, and time zones.
• Collaborative and team-oriented approach, with the ability to work effectively with Security, Engineering, Product, Infrastructure, GRC, Privacy, Legal, and other business stakeholders.
• Intermediate-level cybersecurity certifications such as AZ-500, CySA+, GSOC, or GCIA are an added advantage.
• Excellent analytical and problem-solving abilities.

Education and Skills

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience demonstrating comparable knowledge and job skills.
• Strong understanding of cybersecurity principles, security monitoring, incident response, and security operations processes.
• Strong understanding of common cybersecurity threats, vulnerabilities, attack techniques, and adversary behaviour, with the ability to apply this knowledge during investigations.
• Proficient in security monitoring and inves