Soc Analyst 2

Aspire Systems; Ernakulam, Chennai District, Bengaluru; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

Aspire Systems is seeking a Senior Security Analyst to detect, investigate, and respond to advanced security incidents in a cloud-centric Azure environment using Microsoft Sentinel and Defender XDR.

The role emphasizes threat hunting, incident response leadership, and security automation, going beyond alert triage to drive detection maturity and resilient security operations.

You will mentor junior analysts, coordinate cross-functional responses, and contribute to playbooks and SOC readiness.

Qualifications

• Requires deep technical expertise in threat hunting and incident response.
• Must map detections to MITRE ATT&CK techniques.
• Experience with Defender for Endpoint, Defender for Identity, Defender for Office 365.
• Strong understanding of cloud security in Azure.

Responsibilities

• Lead in-depth investigations of security incidents escalated from L1 analysts and correlate alerts.
• Analyze alerts, logs, and telemetry from Defender and Azure resources.
• Validate and prioritize events based on severity, risk, and impact.
• Use Sentinel investigation graphs and Defender XDR hunting to analyze attack timelines.
• Perform proactive threat hunting using KQL across Sentinel and Defender XDR data sources.
• Coordinate end-to-end incident response across endpoints, identities, and cloud workloads.
• Automate response actions using Sentinel automation and Logic Apps.
• Mentor L1/L2 analysts and contribute to SOC maturity.
• Collaborate with SOC leadership, IT operations, and stakeholders for timely resolutions.
• Document outcomes and lessons learned to improve detections and playbooks.

Skills

Microsoft Sentinel

Microsoft Defender XDR

KQL

MITRE ATT&CK

Education

SC-200

SC-100

AZ-500

Tools

Azure Logic Apps

Job description

Hi,

Greetings from Aspire!

We are looking for SOC analyst L2 in the below locations,

Chennai/ Bangalore/ Kochi/ Hyderabad

Job Description: Senior Security Analyst (Microsoft Sentinel & Defender XDR)

The Senior Security Analyst will play a critical role in detecting, investigating, and responding to advanced security incidents across a cloud-centric Azure environment using Microsoft Sentinel and the Microsoft Defender XDR suite. This role goes beyond alert triage and requires deep technical expertise in threat hunting, incident response leadership, and security automation.

Key Responsibilities

• Lead in-depth investigations of security incidents escalated from L1 analysts, correlating alerts across Microsoft Sentinel and Defender XDR to determine scope, root cause, and business impact.
• Analyze complex security alerts, logs, and telemetry from Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, Azure resources, and integrated third-party solutions.
• Validate, classify, and prioritize security events and incidents based on severity, risk, and business impact.
• Leverage Microsoft Sentinel investigation graphs and Defender XDR advanced hunting capabilities to analyze entities, attack paths, and attack timelines.
• Perform proactive threat hunting using Kusto Query Language (KQL) across Sentinel and Defender XDR data sources to identify undetected or emerging threats.
• Lead and coordinate end-to-end incident response activities, including containment, eradication, and recovery across endpoints, identities, cloud workloads, and SaaS applications.
• Execute and optimize automated response actions using Sentinel automation and Azure Logic Apps (SOAR), such as isolating endpoints, disabling compromised identities, blocking malicious IPs, and enriching incidents with Defender intelligence.
• Mentor L1/L2 analysts, provide guidance during complex investigations, and contribute to SOC process and detection maturity.
• Collaborate with SOC leadership, forensic teams, IT operations, and business stakeholders to ensure effective and timely incident resolution.
• Document investigation outcomes, response actions, and lessons learned to improve detections, playbooks, and overall SOC readiness.

Required Skills and Qualifications

• Expert-level experience with Microsoft Sentinel, including data connectors, analytics rules, incidents, workbooks, hunting queries, and automation.
• Strong hands-on experience with Microsoft Defender XDR, including Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, and Defender for Cloud.
• Advanced Kusto Query Language (KQL) skills for threat hunting, detection engineering, and data analysis across Sentinel and Defender XDR.
• Deep knowledge of the MITRE ATT&CK framework, with the ability to map detections and incidents to tactics and techniques.

Preferred Certifications:

• Microsoft Certified: Security Operations Analyst Associate (SC-200) Most Preferred
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)