Security Operations Center Analyst II

Alvaria CX; India; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

Alvaria CX is seeking a mid-level Security Operations Center Analyst II based in Bangalore with flexible remote/hybrid options after onboarding. The role focuses on independently managing escalated investigations, threat hunting, improving detections, and guiding remediation while mentoring junior analysts.

You will work across identity, endpoint, email, network, cloud telemetry, and vulnerability data to deliver defensible findings to stakeholders.

Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, or a related technical field.
• 3+ years of hands-on SOC/IR/threat detection experience.
• Experience with Microsoft Sentinel and Defender, Sophos or comparable EDR, and vulnerability platforms.
• Strong KQL, investigation, hunting, and detection development skills.
• Good knowledge of Microsoft 365 identity security and cloud telemetry.
• Scripting in PowerShell or Python for investigation support and automation.
• Experience documenting incident findings and developing playbooks.

Responsibilities

• Lead security investigations across SIEM, endpoint, identity, email, vulnerability, network, and cloud telemetry.
• Reconstruct incident timelines and identify affected users and assets with evidence-based root cause findings.
• Perform threat hunting and cross-platform correlation to validate activity and scope.
• Develop, tune, and maintain detection logic and hunting queries to improve signal quality.
• Recommend containment and remediation actions and validate their effectiveness.
• Identify gaps in logging, telemetry, or controls and propose improvements with ownership.
• Develop and maintain SOPs, playbooks, and repeatable analyst workflows.
• Investigate cloud events using AWS or hybrid-cloud telemetry and CSPM tools.
• Mentor junior analysts and review investigation quality for high-impact events.
• Coordinate with IT, identity, endpoint, cloud, and other stakeholders during investigations.
• Produce concise technical findings and executive-ready incident summaries.

Skills

KQL

Threat hunting

PowerShell

Python

Microsoft 365

EDR tooling

Cloud security

MITRE ATT&CK

Education

Bachelor's degree in Cybersecurity

Tools

Microsoft Sentinel

Microsoft Defender

Sophos EDR

Tenable

Job description

Security Operations Center (SOC) Analyst II

Department: Cybersecurity Operations Center (CSOC)

Employment Type: Full-Time

Work Arrangement: Bangalore-based; remote/hybrid options negotiable after onboarding

Role focus: Independently investigate, hunt, improve detections, guide remediation, and mentor junior analysts. Own escalated cases through defensible technical findings.

Job Summary

The Security Operations Center (SOC) Analyst II is a mid-level cybersecurity role responsible for independently managing escalated security investigations, performing threat hunting, improving detection coverage, and developing operational playbooks. The analyst correlates evidence across identity, endpoint, email, network, vulnerability, and cloud telemetry, recommends containment and remediation actions, and communicates defensible findings to technical and business stakeholders. This role also mentors SOC Analyst I team members and helps mature CSOC investigation and detection practices.

Key Responsibilities

• Lead security investigations across SIEM, endpoint, identity, email, vulnerability, network, and cloud security telemetry.
• Reconstruct incident timelines, determine scope, identify affected users and assets, document evidence, and develop evidence-based root cause findings when supported by available telemetry.
• Perform threat hunting and cross-platform correlation to validate suspicious activity, identify related events, and determine whether investigation scope should expand.
• Develop, review, and tune KQL queries, analytic rules, hunting queries, and other detection logic to improve signal quality and coverage.
• Recommend containment and remediation actions based on investigation evidence and validate that corrective actions address the identified security issue.
• Identify detection, logging, telemetry, or control gaps revealed by investigations and recommend practical improvements with clear ownership.
• Develop and maintain SOPs, investigation playbooks, knowledge articles, and repeatable analyst workflows.
• Investigate cloud security events using AWS or hybrid-cloud telemetry and cloud security monitoring/CSPM platforms.
• Support vulnerability analysis by correlating vulnerability data with asset context, exposure, security telemetry, and remediation status.
• Mentor SOC Analyst I team members, review investigation quality, and provide guidance during complex or high impact security events.
• Coordinate with IT, identity, endpoint, cloud, infrastructure, engineering, GRC, and other stakeholders during investigation and remediation activities.
• Produce concise technical findings and executive-ready incident summaries that separate confirmed evidence, analysis, open questions, and recommended next actions.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.
• 3+ years of hands-on experience in a SOC, incident response, threat detection, security engineering, or closely related operational security role.
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender, Sophos or comparable EDR platforms, Tenable or comparable vulnerability platforms, and enterprise security monitoring tools.
• Intermediate to advanced KQL skills for investigation, hunting, correlation, and detection development.
• Strong understanding of Microsoft 365 and identity security, including authentication events, MFA, account activity, session behavior, and suspicious access patterns.
• Experience investigating endpoint activity using process trees, file hashes, command lines, persistence indicators, and network connections.
• Experience with AWS or hybrid-cloud security monitoring and cloud security posture or workload protection concepts.
• Working knowledge of PowerShell or Python for investigation support, data analysis, or security automation.
• Experience documenting incident response findings, developing playbooks, and communicating remediation recommendations.
• Strong technical writing and stakeholder communication skills with the ability to work independently with minimal oversight.

Preferred Skills and Certifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• CompTIA CySA+, GIAC Certified Incident Handler (GCIH), Microsoft Cybersecurity Architect Expert, AWS Certified Security - Specialty, or comparable security certification.
• Experience creating or tuning detections in Microsoft Sentinel or comparable SIEM platforms.
• Experience with threat hunting methodologies and mapping observed activity to MITRE ATT&CK techniques when appropriate.
• Experience with ITSM workflows, ticket lifecycle management, and evidence-driven security documentation.
• Experience mentoring junior analysts, performing investigation quality reviews, or helping standardize SOC operating procedures.

Success in This Role

Success is demonstrated through independent investigation quality, defensible findings, effective threat hunting and detection improvement, strong cross-team coordination, and measurable development of junior analysts.