SOC L2

CMS Computers Ltd; New Delhi; On-site; INR 1,100,000 - 1,900,000; Full time

Job summary

CMS Computers Ltd invites an experienced SOC L2 Analyst to Delhi. The role requires 5+ years in security operations, incident management, threat monitoring, and security event analysis, with strong hands-on ArcSight SIEM expertise and ESM.

You will monitor events, conduct L2 investigations, fine-tune correlation rules, perform log analysis, and collaborate with L1, Incident Response, and Network teams to resolve incidents and improve alert quality.

Qualifications

• 5+ years of experience in SOC / Cyber Security Operations.
• Strong hands-on experience with ArcSight SIEM is mandatory.
• Experience with ArcSight ESM.
• Good understanding of ArcSight correlation rules and log analysis.
• Knowledge of TCP/IP, DNS, HTTP/HTTPS, VPN, firewalls, IDS/IPS, and networking.
• Experience in incident management and escalation procedures.

Responsibilities

• Monitor and analyze security events and alerts using ArcSight SIEM.
• Perform L2-level investigation and analysis of security incidents.
• Develop, fine-tune, and troubleshoot ArcSight correlation rules and SIEM use cases.
• Coordinate with L1 analysts, Incident Response, Network, System, and other teams for incident resolution.
• Create and maintain incident reports and SOC documentation.
• Ensure adherence to defined SLA, incident management, and SOC processes.

Skills

SOC / Cyber Security Operations

Incident management

Threat monitoring

Security event analysis

Log analysis

Networking concepts

Windows/Linux security events

MITRE ATT&CK framework

Tools

ArcSight SIEM

ArcSight ESM

Job description

We are urgently hiring for SOC L2 Engineer at Delhi Location.

Job Summary

We are looking for an experienced SOC L2 Analyst with 5+ years of experience in Security Operations, incident management, threat monitoring, and security event analysis. The candidate should have strong hands‑on experience with Micro Focus/ArcSight SIEM, including correlation rules, use cases, log analysis, incident investigation, and troubleshooting.

Key Responsibilities

• Monitor and analyze security events and alerts using ArcSight SIEM.


• Perform L2-level investigation and analysis of security incidents.


• Investigate suspicious activities, security breaches, malware, unauthorized access, and other threats.


• Develop, fine‑tune, and troubleshoot ArcSight correlation rules and SIEM use cases.


• Perform log analysis across various security devices and technologies.


• Correlate events from firewalls, IDS/IPS, endpoint security, servers, applications, and network devices.


• Conduct incident triage, determine severity, and initiate appropriate response/escalation.


• Perform root‑cause analysis and provide recommendations for incident remediation.


• Identify false positives and continuously improve alert quality and SOC monitoring.


• Create and maintain incident reports, investigation reports, and SOC documentation.


• Coordinate with L1 analysts, Incident Response, Network, System, and other security teams for incident resolution.


• Support threat hunting and identification of indicators of compromise (IOCs).


• Participate in SOC process improvement, security use‑case development, and operational activities.


• Ensure adherence to defined SLA, incident management, and SOC processes.

Mandatory Technical Skills

• 5+ years of experience in SOC / Cyber Security Operations.


• Strong hands‑on experience with ArcSight SIEM is mandatory.


• Experience in ArcSight Enterprise Security Manager (ESM).


• Good understanding of ArcSight correlation rules, filters, dashboards, connectors, and event management.


• Strong knowledge of SIEM monitoring and log correlation.


• Experience in investigating security incidents and performing event/alert analysis.


• Good understanding of TCP/IP, DNS, HTTP/HTTPS, VPN, firewalls, IDS/IPS, and networking concepts.


• Knowledge of Windows and Linux security events/logs.


• Understanding of common cyber threats, attack techniques, and MITRE ATT&CK framework.


• Experience with incident management and SOC escalation procedures.

Good to Have

• Experience with other SIEM tools such as Splunk, IBM QRadar, Microsoft Sentinel, etc.


• Knowledge of EDR/XDR solutions.


• CEH, Security+, CySA+, CISSP or other relevant cybersecurity certifications.


• Experience in threat hunting and vulnerability/security monitoring.

Key Requirement

Candidates must have strong hands‑on ArcSight experience. Candidates with only generic SOC/SIEM experience but without relevant ArcSight exposure should not be considered.