L3 SOC Analyst

Envision Technology Solutions; India; Remote; INR 2,500,000 - 4,500,000; Full time

Job summary

Envision Technology Solutions is seeking an experienced L3 SOC Analyst Incident Responder to lead advanced security investigations and coordinate incident response activities. You will enhance detection and response capabilities across SIEM, SOAR, EDR, and cloud security, collaborating with L1/L2 analysts and customer stakeholders.

The role acts as a senior technical authority within the SOC, developing advanced detection use cases, threat hunting strategies, and ensuring alignment with MITRE

Qualifications

• Bachelor's degree in computer science, cybersecurity or related field or equivalent hands-on experience.
• 8–12 years of experience in Security Operations, Threat Detection or Incident Response roles.
• Expert knowledge of SIEM tools, SOAR platforms, EDR and DLP solutions.
• Strong understanding of MITRE ATT&CK, NIST CSF and incident response lifecycle.

Responsibilities

• Lead investigations, containment, eradication and recovery of complex security incidents.
• Coordinate incident response activities and align with MTIs, L1/L2 analysts and stakeholders.
• Develop and refine detection use cases, including UEBA and threat intelligence based detections.
• Mentor L1/L2 SOC analysts and drive escalation workflows.

Skills

Analytical thinking

Communication

Leadership

Team collaboration

Education

Bachelor's degree in Computer Science/Cybersecurity or related field

Tools

LogRhythm

Securonix

Azure Sentinel

Splunk

Palo Alto XSIAM

Splunk SOAR

Securonix SOAR

Palo Alto XSOAR

CrowdStrike

Microsoft Defender for Endpoint

Job description

Job Summary

We are seeking an experienced and technically proficient L3 SOC Analyst Incident Responder to lead advanced security investigations coordinate incident response activities and enhance the organization s detection and response capabilities This role requires deep hands on expertise in SIEM SOAR EDR and cloud security technologies as well as the ability to collaborate effectively with L1 L2 analysts and customer stakeholders

The L3 Analyst serves as a senior technical authority within the SOC driving complex investigations developing advanced detection use cases refining threat hunting strategies and ensuring alignment with frameworks like MITRE ATT and CK and NIST

Key Responsibilities

Advanced Monitoring and Incident Response

Lead the investigation containment eradication and recovery of complex security incidents following NIST Incident Response framework

Provide end to end incident response management including coordination with internal and external stakeholders

Perform root cause analysis forensics and post incident reporting to prevent recurrence

Guide and support L1 and L2 SOC Analysts in escalated incident analysis and response workflows

SIEM Operations and Engineering

Hands on experience with multiple SIEM platforms such as LogRhythm Securonix Azure Sentinel Splunk and Palo Alto XSIAM

Manage log integration parsing normalization and correlation from diverse data sources endpoints network cloud and applications

Develop and optimize detection use cases based on UEBA insider threats and threat intelligence aligned with MITRE ATT and CK TTPs

Validate quality fine tune correlation rules and reduce false positives across the SOC environment

Threat Hunting and Threat Intelligence

Conduct proactive threat hunting using SIEM EDR IDP and cloud security platforms Azure preferred

Utilize threat intelligence feeds to enhance detection logic and enrich incident analysis

Correlate threat indicators with real time telemetry to identify advanced persistent threats APTs and targeted attacks

SOAR Automation and Process Improvement

Design implement and optimize SOAR playbooks across Splunk SOAR Securonix SOAR and Palo Alto XSOAR

Automate routine SOC workflows to improve incident response efficiency and consistency

Collaborate with engineering and architecture teams to enhance SOC tool integration and response orchestration

Endpoint and Data Security

Perform advanced endpoint analysis using CrowdStrike Falcon and Microsoft Defender for Endpoint MDE

Investigate and remediate Data Loss Prevention DLP incidents and policy violations

Provide technical guidance on endpoint hardening and data protection strategies

Collaboration and Customer Engagement

Act as a senior point of contact for L1 and L2 analysts mentoring reviewing cases and providing technical direction

Drive customer calls understand client specific security challenges and deliver customized solutions

Communicate complex security issues clearly to both technical and non technical stakeholders

Contribute to continuous SOC process improvement reporting and compliance initiatives

Required Skills and Qualifications

Bachelor s degree in computer science Cybersecurity or related field or equivalent hands on experience

8 to 12 years of experience in Security Operations Threat Detection or Incident Response roles

Expert knowledge of

SIEM Tools LogRhythm Securonix Azure Sentinel Splunk Palo Alto XSIAM

SOAR Platforms Splunk SOAR Securonix SOAR Palo Alto XSOAR

EDR CrowdStrike Microsoft Defender for Endpoint

DLP Solutions Email Security Tools and Cloud Security Azure preferred

Strong understanding of MITRE ATT and CK NIST Cybersecurity Framework and incident response lifecycle

Proven experience in building and refining detection use cases particularly UEBA insider threats and threat intelligence based detections

Solid knowledge of network protocols log analysis and digital forensics

Excellent analytical thinking communication and leadership skills

Willingness to work in a 24 7 rotational shift environment