SOC Analyst L3

Wipro; Hyderabad, Pune District, Bengaluru; Hybrid; INR 4,000,000 - 6,000,000; Full time

Job summary

Wipro seeks a senior SOC technical expert to lead advanced threat detection, complex incident response, threat hunting, and detection engineering. You will guide L1/L2 analysts, mentor teams, and drive SOC capability improvements across endpoints, networks, cloud, and identity platforms.

The role emphasizes technical leadership during high-severity incidents, development of SIEM/EDR/XDR use-cases, and continuous optimization of SOC processes and KPIs.

Qualifications

• Expert understanding of SOC operations, threat detection, and incident response.
• Deep knowledge of SIEM, EDR/XDR, SOAR, IDS/IPS, firewall, identity, email, cloud, and network security technologies.
• In-depth knowledge of MITRE ATT&CK techniques and attacker TTPs.
• Strong experience in threat hunting, malware analysis, digital forensics, and threat intelligence.
• Proficiency in building detection logic and telemetry-driven analytics.

Responsibilities

• Lead investigations of complex and high-severity cybersecurity incidents.
• Conduct deep-dive analysis across endpoint, network, identity, email, cloud, and security telemetry.
• Identify attacker TTPs, attack paths, persistence mechanisms, lateral movement, and compromised assets.
• Lead containment, eradication, recovery, and post-incident analysis activities.
• Perform advanced threat hunting based on emerging threats, intelligence, threat hypotheses, and behavioral indicators.
• Design, develop, test, and tune SIEM detection rules and analytics.
• Develop detection coverage mapped to MITRE ATT&CK techniques.
• Identify visibility and detection gaps and recommend improvements to security controls.
• Develop or enhance SOAR automation and incident‑response workflows.
• Support malware analysis, forensic investigation, and evidence collection where required.
• Lead root‑cause analysis and preparation of detailed incident reports.
• Conduct post‑incident reviews and convert lessons learned into detection and process improvements.
• Mentor L1/L2 analysts and provide technical guidance during complex investigations.
• Collaborate with Cyber Threat Intelligence, Incident Response, Digital Forensics, Vulnerability Management, IAM, network, cloud, and infrastructure teams.
• Support continuous improvement of SOC KPIs, playbooks, runbooks, and operating procedures.

Skills

SIEM expertise

EDR/XDR mastery

SOAR automation

MITRE ATT&CK knowledge

KQL / SPL skills

Python / PowerShell

Incident leadership

Cross-team coordination

Tools

Microsoft Sentinel

Splunk

IBM QRadar

Microsoft Defender XDR

CrowdStrike

SentinelOne

Job description

Purpose

Act as a senior SOC technical expert responsible for advanced threat detection, complex incident response, threat hunting, detection engineering, and continuous improvement of SOC capabilities. Provide technical leadership during high-severity cybersecurity incidents and guide L1/L2 analysts.

Area of Responsibility

• Advanced incident response and technical leadership.
• Major/high-severity incident investigation.
• Advanced threat hunting.
• Detection engineering and SIEM use-case development.
• EDR/XDR investigation and response.
• Malware and attack-chain analysis.
• SOC automation and orchestration.
• Threat intelligence integration.
• SOC capability and process improvement.
• Technical mentoring and quality assurance.

Tasks

• Lead investigations of complex and high-severity cybersecurity incidents.
• Conduct deep-dive analysis across endpoint, network, identity, email, cloud, and security telemetry.
• Identify attacker TTPs, attack paths, persistence mechanisms, lateral movement, and compromised assets.
• Lead containment, eradication, recovery, and post-incident analysis activities.
• Perform advanced threat hunting based on emerging threats, intelligence, threat hypotheses, and behavioral indicators.
• Design, develop, test, and tune SIEM detection rules and analytics.
• Develop detection coverage mapped to MITRE ATT&CK techniques.
• Identify visibility and detection gaps and recommend improvements to security controls.
• Develop or enhance SOAR automation and incident‑response workflows.
• Support malware analysis, forensic investigation, and evidence collection where required.
• Lead root‑cause analysis and preparation of detailed incident reports.
• Conduct post‑incident reviews and convert lessons learned into detection and process improvements.
• Mentor L1/L2 analysts and provide technical guidance during complex investigations.
• Collaborate with Cyber Threat Intelligence, Incident Response, Digital Forensics, Vulnerability Management, IAM, network, cloud, and infrastructure teams.
• Support continuous improvement of SOC KPIs, playbooks, runbooks, and operating procedures.

Knowledge

• Expert understanding of SOC operations, threat detection, and incident response.
• Strong knowledge of SIEM, EDR/XDR, SOAR, IDS/IPS, firewall, identity, email, cloud, and network security technologies.
• Deep understanding of Windows/Linux internals, Active Directory, Entra ID, endpoint, network, and cloud attacks.
• Advanced knowledge of MITRE ATT&CK and attacker TTPs.
• Knowledge of threat hunting, malware analysis, digital forensics, and threat intelligence.
• Understanding of detection engineering principles and security telemetry.
• Knowledge of major incident response and post‑incident review methodologies.

Skills

• Advanced expertise with SIEM platforms such as Microsoft Sentinel, Splunk, or IBM QRadar.
• Advanced investigation using Microsoft Defender XDR, CrowdStrike, SentinelOne, or equivalent platforms.
• Advanced KQL, SPL, or other security query languages.
• Threat hunting and detection engineering.
• Advanced incident investigation and root‑cause analysis.
• SOAR/playbook development and security automation.
• Scripting using Python and/or PowerShell.
• Ability to lead critical incident investigations and coordinate multiple technical teams.
• Strong stakeholder communication, documentation, mentoring, and technical leadership skills.