Soc Analyst 2

Wipro; Hyderabad, Pune District, Bengaluru; Híbrido; INR 1.200.000 - 2.400.000; Tempo integral

Resumo da vaga

Wipro is seeking a Level 2 Security Incident Response Analyst to perform detailed security incident investigations, containment, and response across on-premises and cloud environments in Hyderabad, India. This role focuses on escalation handling, threat hunting, and improving SOC detection and response capabilities.

The ideal candidate will have hands-on experience with SIEM/EDR platforms, threat intelligence, MITRE ATT&CK mappings, and strong analytical skills to mentor L1 analysts and

Qualificações

• Strong understanding of SOC monitoring and incident response processes.
• Experience with SIEM/EDR investigations and correlation.
• Knowledge of MITRE ATT&CK techniques and threat hunting.
• Ability to mentor L1 analysts and document findings clearly.

Responsabilidades

• Investigate security incidents escalated by L1 analysts.
• Correlate events across SIEM, EDR/XDR, firewall, identity, cloud, email, and network security platforms.
• Perform detailed investigation of malware, phishing, credential compromise, and lateral movement.
• Identify attack vectors, affected assets, indicators of compromise, and business impact.
• Recommend containment and remediation actions per procedures.
• Map attacker behavior to MITRE ATT&CK techniques.
• Support tuning of SIEM rules and detection use cases.

Conhecimentos

Threat hunting

IOC/TPP analysis

Incident investigation

L2 escalation

Mentoring L1 analysts

Root-cause analysis

SOCs process improvement

PowerShell/Python

KQL/SPL

Communication skills

Ferramentas

Microsoft Sentinel

Splunk

IBM QRadar

EDR/XDR tools

Descrição da vaga

Purpose

Perform detailed security incident investigation, analysis, containment, and response. Provide Level 2 support for escalated alerts and incidents, conduct threat hunting, and improve SOC detection and response capabilities.

Area of Responsibility

• Advanced security incident investigation.
• Incident response and containment.
• SIEM/EDR investigation and correlation.
• Threat hunting and proactive analysis.
• Detection and use-case improvement.
• L1 escalation support and mentoring.
• Root-cause analysis.
• SOC process improvement.

Tasks

• Investigate security incidents escalated by L1 analysts.
• Correlate events across SIEM, EDR/XDR, firewall, identity, cloud, email, and network security platforms.
• Perform detailed investigation of malware, phishing, credential compromise, suspicious authentication, lateral movement, and endpoint/network attacks.
• Identify attack vectors, affected assets, indicators of compromise, and potential business impact.
• Recommend or execute appropriate containment and remediation actions according to approved procedures.
• Perform threat hunting based on IOCs, TTPs, intelligence, and anomalous behavior.
• Map observed attacker behavior against MITRE ATT&CK techniques.
• Perform root-cause analysis and document incident findings.
• Support tuning of SIEM correlation rules and detection use cases to reduce false positives.
• Develop and improve SOC investigation playbooks.
• Mentor L1 analysts and perform quality reviews of escalated incidents.
• Contribute to incident reports, dashboards, KPIs, and customer/service review meetings.

Knowledge

• Strong understanding of SOC monitoring and incident response processes.
• Good understanding of Windows, Linux, Active Directory, Entra ID, cloud, and network security.
• Knowledge of common attack techniques, malware behavior, credential attacks, persistence, privilege escalation, and lateral movement.
• Strong understanding of SIEM correlation and log analysis.
• Working knowledge of EDR/XDR investigation.
• Knowledge of MITRE ATT&CK, Cyber Kill Chain, and incident response frameworks.
• Understanding of threat intelligence and threat-hunting methodologies.

Skills

• Hands-on experience with Microsoft Sentinel, Splunk, IBM QRadar, or equivalent SIEM.
• Experience with Microsoft Defender XDR, CrowdStrike, SentinelOne, or equivalent EDR/XDR.
• Advanced log correlation and incident investigation.
• Threat hunting and IOC/TTP analysis.
• SIEM use-case tuning and detection enhancement.
• Basic scripting capability using PowerShell, Python, or KQL/SPL.
• Strong analytical, troubleshooting, and root-cause-analysis skills.
• Ability to mentor L1 analysts and communicate incident findings clearly.