Security Operations Center Analyst- L2

Incedo Inc.; Gurugram District; On-site; INR 900,000 - 1,500,000; Full time

Job summary

Incedo Inc. in Gurgaon is seeking a Security Operations Center (SOC) L2 Analyst with 4–7 years of cyber security experience. The role covers security monitoring, incident investigation, and response across endpoints, networks, cloud, and identity platforms.

You will investigate incidents, perform log analysis, validate alerts, and coordinate remediation with L3 engineers and other teams, while meeting SLA in a 24x7 SOC environment.

Qualifications

• Bachelor's degree required in CS/IT/Cyber Security or related field.
• Hands-on security monitoring and incident response experience.
• Experience with SIEM, EDR/XDR, and cloud security fundamentals.

Responsibilities

• Investigate and analyze security incidents escalated by the L1 SOC team.
• Perform alert triage, log analysis, event correlation, and root cause analysis.
• Validate security alerts and distinguish true positives from false positives.
• Investigate phishing, malware, unauthorized access, privilege escalation, and cloud security incidents.
• Monitor and analyze security events across endpoints, networks, cloud, and identity platforms.
• Coordinate with L3 engineers, infrastructure teams, and other stakeholders for incident remediation.
• Maintain incident documentation, investigation reports, and ticket updates.
• Ensure SLA adherence in a 24x7 SOC environment.

Skills

Security Operations

Incident Response

Log Analysis

Threat Hunting

Communication Skills

Education

Bachelor's degree in Computer Science, Information Technology, Cyber Security, or related field

Tools

Splunk

QRadar

Microsoft Sentinel

LogRhythm

CrowdStrike

Microsoft Defender

SentinelOne

Cortex XDR

Firewall

IDS/IPS

WAF

VPN

Email Security

Endpoint Security

Windows

Linux

Active Directory

Microsoft 365

CloudTrail

TCP/IP

DNS

HTTP/HTTPS

SMTP

Job description

Role: Security Operations Center (SOC) - L2 Analyst

Experience

• 4-7 years of experience in Cyber Security Operations / SOC
• 3+ years of hands-on experience in security monitoring, incident investigation, and incident response

Key Responsibilities

• Investigate and analyze security incidents escalated by the L1 SOC team
• Perform alert triage, log analysis, event correlation, and root cause analysis
• Validate security alerts and distinguish true positives from false positives
• Investigate phishing, malware, unauthorized access, privilege escalation, and cloud security incidents
• Monitor and analyze security events across endpoints, networks, cloud, and identity platforms
• Coordinate with L3 engineers, infrastructure teams, and other stakeholders for incident remediation
• Maintain incident documentation, investigation reports, and ticket updates
• Ensure SLA adherence in a 24x7 SOC environment

Must-Have Skills

• SIEM: Splunk, QRadar, Microsoft Sentinel, LogRhythm
• EDR/XDR: CrowdStrike, Microsoft Defender, SentinelOne, Cortex XDR
• Security Monitoring: Firewall, IDS/IPS, WAF, VPN, Email Security, Endpoint Security
• Log Analysis: Windows, Linux, Active Directory, Microsoft 365, CloudTrail
• Networking: TCP/IP, DNS, HTTP/HTTPS, SMTP

Good-to-Have Skills

• AWS or Azure security
• PowerShell or Python
• Knowledge of the NIST Incident Response Framework

Preferred Certifications

• Security+
• SC-200
• CEH
• CySA+
• Splunk Certified User
• IBM QRadar SIEM Foundation

Education

Bachelor's degree in Computer Science, Information Technology, Cyber Security, or a related field.

Work Location & Shift

• 24x7 rotational shift
• Willingness to work on weekends and holidays as required