Security Operations Center (SOC) Analyst II

Alvaria; Bengaluru; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

Alvaria's Security Operations Center (SOC) Analyst II is a mid-level cybersecurity role based in Bengaluru, with a focus on independently managing escalated investigations, threat hunting, and improving detection coverage. You will correlate identity, endpoint, email, network, and cloud telemetry, propose containment actions, and communicate defensible findings to technical and business stakeholders.

You will also mentor SOC Analyst I teammates, develop operational playbooks, and help mature

Qualifications

• Bachelor's degree in cybersecurity or related field.
• 3+ years in a SOC, incident response, threat detection, or security operations.
• Hands-on experience with SIEM/EDR tools and vulnerability platforms.
• Intermediate to advanced KQL skills for investigations and detection development.
• Strong knowledge of Microsoft 365 identity security and MFA.
• Experience analyzing endpoint activity and network connections.
• PowerShell or Python for investigation support and automation.
• Experience documenting findings and developing playbooks.

Responsibilities

• Lead security investigations across SIEM, endpoint, identity, email, vulnerability, network, and cloud telemetry.
• Reconstruct incident timelines, determine scope, identify affected users and assets, and document evidence.
• Perform threat hunting and cross-platform correlation to expand investigations.
• Develop and tune KQL queries, analytic rules, and hunting queries.
• Recommend containment and remediation actions based on evidence.
• Identify gaps in detection/telemetry and propose improvements with ownership.
• Develop and maintain SOPs, playbooks, and knowledge articles.
• Investigate cloud events using AWS or hybrid-cloud telemetry.
• Support vulnerability analysis with asset context and remediation status.
• Mentor SOC Analyst I, review investigations, and guide junior staff.
• Coordinate with IT, identity, endpoint, cloud, and other stakeholders during investigations.
• Produce concise technical findings and executive-ready incident summaries.

Education

Bachelor's degree in Cybersecurity

Tools

Microsoft Sentinel

Microsoft Defender

Sophos EDR

Tenable

EDR platforms

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Security Operations Center (SOC) Analyst II

Security Full Time Indv. Contributor IN

Security Operations Center (SOC) Analyst II

Department: Cybersecurity Operations Center (CSOC)

Employment Type: Full-Time

Work Arrangement: Bangalore-based; remote/hybrid options negotiable after onboarding

Role focus

Independently investigate, hunt, improve detections, guide remediation, and mentor junior analysts. Own escalated cases through defensible technical findings.

Job Summary

The Security Operations Center (SOC) Analyst II is a mid-level cybersecurity role responsible for independently managing escalated security investigations, performing threat hunting, improving detection coverage, and developing operational playbooks. The analyst correlates evidence across identity, endpoint, email, network, vulnerability, and cloud telemetry, recommends containment and remediation actions, and communicates defensible findings to technical and business stakeholders. This role also mentors SOC Analyst I team members and helps mature CSOC investigation and detection practices.

Key Responsibilities

• Lead security investigations across SIEM, endpoint, identity, email, vulnerability, network, and cloud security telemetry.
• Reconstruct incident timelines, determine scope, identify affected users and assets, document evidence, and develop evidence-based root cause findings when supported by available telemetry.
• Perform threat hunting and cross-platform correlation to validate suspicious activity, identify related events, and determine whether investigation scope should expand.
• Develop, review, and tune KQL queries, analytic rules, hunting queries, and other detection logic to improve signal quality and coverage.
• Recommend containment and remediation actions based on investigation evidence and validate that corrective actions address the identified security issue.
• Identify detection, logging, telemetry, or control gaps revealed by investigations and recommend practical improvements with clear ownership.
• Develop and maintain SOPs, investigation playbooks, knowledge articles, and repeatable analyst workflows.
• Investigate cloud security events using AWS or hybrid-cloud telemetry and cloud security monitoring/CSPM platforms.
• Support vulnerability analysis by correlating vulnerability data with asset context, exposure, security telemetry, and remediation status.
• Mentor SOC Analyst I team members, review investigation quality, and provide guidance during complex or high impact security events.
• Coordinate with IT, identity, endpoint, cloud, infrastructure, engineering, GRC, and other stakeholders during investigation and remediation activities.
• Produce concise technical findings and executive-ready incident summaries that separate confirmed evidence, analysis, open questions, and recommended next actions.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related technical field.
• 3+ years of hands-on experience in a SOC, incident response, threat detection, security engineering, or closely related operational security role.
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender, Sophos or comparable EDR platforms, Tenable or comparable vulnerability platforms, and enterprise security monitoring tools.
• Intermediate to advanced KQL skills for investigation, hunting, correlation, and detection development.
• Strong understanding of Microsoft 365 and identity security, including authentication events, MFA, account activity, session behavior, and suspicious access patterns.
• Experience investigating endpoint activity using process trees, file hashes, command lines, persistence indicators, and network connections.
• Experience with AWS or hybrid-cloud security monitoring and cloud security posture or workload protection concepts.
• Working knowledge of PowerShell or Python for investigation support, data analysis, or security automation.
• Experience documenting incident response findings, developing playbooks, and communicating remediation recommendations.
• Strong technical writing and stakeholder communication skills with the ability to work independently with minimal oversight.

Preferred Skills and Certifications

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• CompTIA CySA+, GIAC Certified Incident Handler (GCIH), Microsoft Cybersecurity Architect Expert, AWS Certified Security - Specialty, or comparable security certification.
• Experience creating or tuning detections in Microsoft Sentinel or comparable SIEM platforms.
• Experience with threat hunting methodologies and mapping observed activity to MITRE ATT&CK techniques when appropriate.
• Experience with ITSM workflows, ticket lifecycle management, and evidence-driven security documentation.
• Experience mentoring junior analysts, performing investigation quality reviews, or helping standardize SOC operating procedures.

Success in This Role

Success is demonstrated through independent investigation quality, defensible findings, effective threat hunting and detection improvement, strong cross-team coordination, and measurable development of junior analysts.