SOC Analyst - L3 Engineer

Hugo Bank; Karachi Division; On-site; PKR 2,400,000 - 3,000,000; Full time

Job summary

Hugo Bank is seeking a skilled SOC Analyst – L3 Engineer to join its Security Operations Center in Karachi. You will act as the primary L3 technical escalation point and support a 24×7 SOC operation, with hands-on work in SIEM, SOAR, Threat Intelligence, Threat Hunting, Incident Response, and MITRE ATT&CK.

You will lead complex investigations, develop detection capabilities, and collaborate with IT and security teams to continuously improve SOC processes and controls.

Qualifications

• 3–4 years of hands-on SOC/Cybersecurity experience.
• Strong experience with SIEM (leading vendors) and SOAR.
• Hands-on experience with Threat Intelligence and Threat Hunting.
• Knowledge of MITRE ATT&CK Framework and detection methodologies.
• Experience with Incident Response and Security Investigation.
• Good understanding of Windows/Linux, EDR/XDR, Firewalls, Network Security, Cloud and Application logs.

Responsibilities

• Act as the L3 escalation point for complex security incidents and provide technical guidance to L1/L2 SOC Analysts.
• Support and coordinate 24×7 SOC operations, shift handovers, incident escalation, and SLA compliance.
• Manage, optimize, and troubleshoot SIEM solutions (commercial and open-source).
• Develop and tune SIEM correlation rules, detection use cases, alerts, dashboards, and monitoring capabilities.
• Develop and maintain SOAR playbooks and automate security investigation and response processes.
• Utilize Threat Intelligence feeds, IOCs, TTPs, and threat actor information to enhance detection capabilities.
• Perform threat hunting and identify advanced threats and detection gaps.
• Implement and map security detections against MITRE ATT&CK and other relevant security frameworks.
• Lead/support incident investigation, containment, root‑cause analysis, and remediation.
• Collaborate with IT, Network, Infrastructure, Application, and other teams for incident resolution.

Skills

SOC analysis

Threat hunting

Incident response

Threat intelligence

MITRE ATT&CK

SLA compliance

Scripting (Python/PowerShell/Bash)

Windows/Linux knowledge

EDR/XDR

Education

Bachelor's degree in Cybersecurity, Information Security, Computer Science, IT

Tools

SIEM

SOAR

EDR/XDR

Firewalls

Cloud logs

Threat intelligence feeds

Job description

About the Role

We are looking for a skilled SOC Analyst – L3 Engineer to join our Security Operations Center. The role will serve as the primary L3 technical escalation point and will support the management of a 24×7 SOC operation. The ideal candidate should have strong hands‑on experience in SIEM, SOAR, Threat Intelligence, Threat Hunting, Incident Response, and MITRE ATT&CK.

Key Responsibilities

• Act as the L3 escalation point for complex security incidents and provide technical guidance to L1/L2 SOC Analysts.
• Support and coordinate 24×7 SOC operations, shift handovers, incident escalation, and SLA compliance.
• Manage, optimize, and troubleshoot commercial and open‑source SIEM solutions.
• Develop and tune SIEM correlation rules, detection use cases, alerts, dashboards, and monitoring capabilities.
• Develop and maintain SOAR playbooks and automate security investigation and response processes.
• Utilize Threat Intelligence feeds, IOCs, TTPs, and threat actor information to enhance detection capabilities.
• Perform threat hunting and identify advanced threats and detection gaps.
• Implement and map security detections against MITRE ATT&CK and other relevant security frameworks.
• Lead/support incident investigation, containment, root‑cause analysis, and remediation.
• Collaborate with IT, Network, Infrastructure, Application, and other teams for effective incident resolution.
• Support continuous improvement of SOC SOPs, playbooks, use cases, and security controls.

• 3–4 years of hands‑on experience in SOC/Cybersecurity/Security Operations.
• Strong experience with SIEM, including leading commercial and/or open‑source solutions.
• Hands‑on experience with SOAR and security automation.
• Practical experience with Threat Intelligence and Threat Hunting.
• Strong knowledge of MITRE ATT&CK Framework and security detection methodologies.
• Experience with Incident Response and Security Investigation.
• Good understanding of Windows/Linux, EDR/XDR, Firewalls, Network Security, Cloud, and Application logs.
• Scripting knowledge in Python, PowerShell, or Bash is an advantage.
• Experience in a 24×7 SOC environment is preferred.

Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, IT, or related field.
• Relevant certifications such as CEH, Security+, CySA+, GCIH, GCIA, CISSP, or SIEM/SOAR/EDR vendor certifications are an advantage.