Sr. Analyst - SOC

Neurealm Company; Maharashtra; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

Neurealm Company in Pune is seeking an experienced L2 SOC Analyst to monitor, triage, and respond to security incidents in a 24x7 SOC.

You will analyze logs from SIEM/EDR, investigate malware and data exfiltration, and perform root-cause analyses to determine impact. Strong scripting and collaboration with cross-functional teams are essential for success.

Qualifications

• 5–8 years of experience in a SOC or security operations role.
• Experience in L2 security monitoring and incident response.
• Strong log analysis and threat hunting capabilities.
• Good scripting skills and ability to automate SOC tasks.

Responsibilities

• Perform L2 monitoring, triage, investigation, and response in a 24x7 SOC.
• Analyze and correlate logs from SIEM, EDR/XDR, firewalls, and cloud apps.
• Investigate malware, phishing, compromised accounts, and data exfiltration.
• Conduct root-cause analysis and determine incident scope and impact.
• Create and tune detection rules and alerts; reduce false positives.
• Coordinate with multiple teams for containment and remediation.
• Prepare incident reports, timelines, RCA, and SOC documentation.
• Develop SOC playbooks and automation scripts to improve efficiency.

Skills

SOC monitoring

Incident response

Log analysis

Threat hunting

Scripting

Communication

Education

Bachelor's degree in IT/CS

Tools

SIEM

EDR/XDR

Firewalls

Cloud security

Job description

• Perform L2 monitoring, triage, investigation, and response to security alerts and incidents in a 24x7 SOC environment.
• Analyze and correlate logs from SIEM, EDR/XDR, firewalls, network devices, servers, cloud, identity, and security applications.
• Investigate security incidents such as malware, phishing, compromised accounts, suspicious network activity, privilege escalation, lateral movement, and data exfiltration.
• Conduct root-cause analysis, identify attack techniques/TTPs, and determine the scope and impact of incidents.
• Perform threat hunting and proactively identify suspicious activities, IOCs, and emerging threats.
• Create, validate, and tune SIEM correlation rules, detection use cases, and alerts based on organizational requirements.
• Perform false-positive analysis and detection tuning to improve alert accuracy and SOC efficiency.
• Analyze threat intelligence, vulnerabilities, IOCs, and TTPs and correlate them with internal security events.
• Support investigation and response to critical and high-severity incidents, escalating complex cases to L3/Incident Response teams with complete evidence and analysis.
• Coordinate with Network, Server, Cloud, IT, IAM, Vulnerability Management, and other technology teams for containment and remediation.
• Monitor and validate the health and availability of critical security monitoring/log sources and report gaps or ingestion issues.
• Prepare and maintain incident reports, investigation timelines, RCA, security advisories, and SOC documentation.
• Maintain accurate incident records and updates on ServiceNow, ManageEngine or other ITSM platforms.
• Develop and maintain SOC playbooks, SOPs, knowledge articles, and investigation procedures.
• Use Python, PowerShell, Bash, or other scripting languages to automate repetitive SOC activities and analysis.
• Perform basic network/packet analysis and investigate suspicious network communications.
• Contribute to SOC dashboards, metrics, trend analysis, and management reporting.
• Share investigation findings, threat intelligence, and lessons learned with other SOC analysts and security teams.
• Continuously improve SOC detection coverage, incident response processes, monitoring capabilities, and operational efficiency.

Experience Required

• 5 - 8 years

Location

• Pune, Maharashtra, India (PUN)

Job Summary

Location: Chennai or Pune

Key Responsibilities – L2 SOC Analyst

• Perform L2 monitoring, triage, investigation, and response to security alerts and incidents in a 24x7 SOC environment.
• Analyze and correlate logs from SIEM, EDR/XDR, firewalls, network devices, servers, cloud, identity, and security applications.
• Investigate security incidents such as malware, phishing, compromised accounts, suspicious network activity, privilege escalation, lateral movement, and data exfiltration.
• Conduct root-cause analysis, identify attack techniques/TTPs, and determine the scope and impact of incidents.
• Perform threat hunting and proactively identify suspicious activities, IOCs, and emerging threats.
• Create, validate, and tune SIEM correlation rules, detection use cases, and alerts based on organizational requirements.
• Perform false-positive analysis and detection tuning to improve alert accuracy and SOC efficiency.
• Analyze threat intelligence, vulnerabilities, IOCs, and TTPs and correlate them with internal security events.
• Support investigation and response to critical and high-severity incidents, escalating complex cases to L3/Incident Response teams with complete evidence and analysis.
• Coordinate with Network, Server, Cloud, IT, IAM, Vulnerability Management, and other technology teams for containment and remediation.
• Monitor and validate the health and availability of critical security monitoring/log sources and report gaps or ingestion issues.
• Prepare and maintain incident reports, investigation timelines, RCA, security advisories, and SOC documentation.
• Maintain accurate incident records and updates on ServiceNow, ManageEngine or other ITSM platforms.
• Develop and maintain SOC playbooks, SOPs, knowledge articles, and investigation procedures.
• Use Python, PowerShell, Bash, or other scripting languages to automate repetitive SOC activities and analysis.
• Perform basic network/packet analysis and investigate suspicious network communications.
• Contribute to SOC dashboards, metrics, trend analysis, and management reporting.
• Share investigation findings, threat intelligence, and lessons learned with other SOC analysts and security teams.
• Continuously improve SOC detection coverage, incident response processes, monitoring capabilities, and operational efficiency.

Certification

• Security certifications such as SC-200, Security+, CySA+, CEH, GCIH, GCIA, or equivalent are preferred.

Communication & Documentation

• Strong written and verbal communication skills.
• Ability to prepare clear incident reports, investigation summaries, RCA documents, security advisories, and management updates.
• Ability to communicate technical security findings to both technical and non-technical stakeholders.
• Ability to contribute to SOC documentation, playbooks, SOPs, dashboards, and knowledge repositories.