Engineer II - L2 SOC

Wipfli; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Wipfli in Bengaluru seeks a SOC L2 Engineer to monitor and analyze security alerts from SIEM platforms, perform continuous security monitoring of networks, endpoints, and logs, and investigate incidents.

The role requires 3–5 years of experience, exposure to SOC operations, and hands-on experience with SIEM tools such as Elastic SIEM, Microsoft Sentinel, Splunk, or QRadar; certifications like CEH or Microsoft SC-200/SC-900 are a plus.

Qualifications

• Bachelor’s degree in computer science or related field.
• Exposure to SOC operations and cybersecurity monitoring.
• Hands-on experience with SIEM tools and security alert investigation preferred.

Responsibilities

• Monitor and analyze security alerts from SIEM platforms.
• Perform continuous security monitoring of network and endpoint activity.
• Investigate incidents with detailed log analysis to detect anomalies.
• Classify alerts as True Positive or False Positive based on evidence.
• Respond to incidents according to playbooks and SOPs.
• Escalate high-severity incidents with proper context and impact analysis.
• Analyze phishing emails including header, URL, and attachments.
• Track malware alerts using EDR telemetry and sandbox results.
• Monitor endpoint activity with EDR tools.
• Support vulnerability assessment and remediation tracking.
• Maintain incident reports and SOC documentation.
• Follow threat intel updates and apply insights to investigations.
• Adhere to SOC SLAs and escalation procedures.
• Review client Baseline Security Reviews and document gaps.

Skills

Networking basics

Cyber security fundamentals

Windows/Linux familiarity

Incident response concepts

Alert triage

Education

Bachelor's degree in Computer Science / Information Security / IT

Tools

Elastic SIEM

Microsoft Sentinel

Wazuh

Splunk

QRadar

Job description

Job Description:

Overview

Position: SOC L2 engineer

(3 to 5 years of experience)

Type: Full Time Employee (FTE)

Roles and Responsibilities:

• Monitor and analyze security alerts generated by SIEM platforms including Elastic SIEM, Microsoft Sentinel, and other SIEM tools (e.g., Wazuh, Splunk, QRadar).
• Perform continuous security monitoring of network traffic, endpoint activity, and system logs to identify suspicious or malicious behavior.
• Investigate potential security incidents by performing detailed log analysis to detect anomalies and attack patterns.
• Classify security alerts accurately as True Positive or False Positive based on evidence and analysis.
• Respond to security incidents promptly by following defined incident response playbooks and SOPs.
• Escalate confirmed or high-severity incidents to senior SOC engineers with proper documentation, context, and impact analysis.
• Conduct phishing email analysis, including:
  • Header and sender analysis
  • URL and attachment inspection
  • Identification of credential-harvesting and malware delivery attempts
• Track and investigate malware alerts, performing basic static and behavioral analysis using EDR telemetry and sandbox results.
• Monitor and analyze endpoint activity using EDR tools such as Sentinel One and Microsoft Defender for Endpoint.
• Support vulnerability assessment activities by reviewing scan results, validating findings, and assisting with remediation tracking.
• Maintain accurate incident reports, investigation notes, and SOC documentation.
• Follow daily threat intelligence updates and apply relevant insights to ongoing investigations.
• Adherent to SOC SLAs, escalation procedures, and operational best practices
• Support client Baseline Security Reviews by reviewing security tool configurations and documenting gaps against defined security baselines.

Technology skills and Competencies:

• Basic to intermediate understanding of networking, security, and system administration concepts.
• Knowledge of:
• Network security fundamentals
• Firewalls, IDS/IPS, and SIEM to
• Vulnerability assessment concepts and security best practices
• Familiarity with Windows and/or Linux environments.
• Hands-on exposure to:
• SIEM monitoring and alert investigation
• Incident response and alert triage
• Endpoint detection and response (EDR) tools
• Understanding of common attack techniques including phishing, malware, brute force, and credential abuse.

Certifications:

• CEH (Certified Ethical Hacker)
• Microsoft SC-200 - Security Operations Analyst
• Microsoft SC-900 or equivalent security fundamentals certification

Qualifications and experience:

• Bachelor’s degree in computer science, Information Security, Information Technology, or a related field (or equivalent practical experience).
• Exposure to SOC operations
• Exposure to Cybersecurity monitoring
• Hands-on experience with SIEM tools and security alert investigation is preferred.

Requirements: