SOC Analyst- Tier 2 Investigation

Madre Me; Doha; On-site; QAR 120,000 - 160,000; Full time

Job summary

Madre Integrated Engineering in Doha seeks an experienced Senior SOC Analyst to monitor, analyze, and respond to security incidents across enterprise environments. You will triage alerts, perform advanced investigations, and mentor junior analysts.

You will work with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, and ArcSight, conduct threat hunting, develop detection logic, and document findings to improve security operations.

Qualifications

• Bachelor's degree required in a related field.
• 5–8 years in a Cyber Security Operations Center (SOC).
• Certifications: CompTIA CySA+ or GIAC GCIA preferred.

Responsibilities

• Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
• Perform detailed analysis of events, logs, network traffic, and endpoint activities to identify malicious behavior.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze IOCs/IOAs to determine scope and impact of security incidents.
• Proactively hunt threats using SIEM, EDR, and threat intelligence platforms.
• Investigate advanced threats, malware infections, phishing, insider threats, and anomalies.
• Correlate events from multiple tools to identify attack patterns and breaches.
• Develop detection logic, use cases, and SOC playbooks; document findings.

Skills

SOC operations

Threat hunting

Incident response

Log analysis

SIEM use

EDR/XDR

Education

Bachelor's degree in Cybersecurity or related field

Tools

Microsoft Sentinel

Splunk

IBM QRadar

ArcSight

Job description

Madre Integrated Engineering | Full time

• Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
  
• Perform detailed analysis of security events, logs, network traffic, and endpoint activities to identify malicious behavior.
  
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
  
• Analyze Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) to determine the scope and impact of security incidents.
  
• Perform proactive threat hunting exercises using SIEM, EDR, and threat intelligence platforms.
  
• Investigate advanced threats, malware infections, phishing attacks, insider threats, and anomalous activities.
  
• Correlate events from multiple security tools to identify attack patterns and potential breaches.
  
• Develop and enhance use cases, detection rules, correlation logic, and SOC playbooks.
  
• Document investigation findings, root cause analysis, and incident reports.
  
• Collaborate with IT, infrastructure, network, and application teams during incident response activities.
  
• Support digital forensics activities and evidence collection when required.
  
• Participate in security incident response drills and continuous improvement initiatives.
  
• Mentor junior SOC analysts and provide technical guidance on complex investigations.
  

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
  
• 5-8 years of experience in Cyber Security Operations Center (SOC) environments.
  
• Minimum 3+ years of experience performing Tier 2 or advanced security investigations.
  
• Professional certification:
  • CompTIA CySA+ (Cybersecurity Analyst), or
    
  • GIAC Certified Intrusion Analyst (GCIA)
    
• Strong understanding of:
  • Security Incident Response
    
  • Threat Detection and Analysis
    
  • Network Security
    
  • Endpoint Security
    
  • Security Monitoring
    
  • Threat Intelligence
    
• Experience with enterprise SIEM platforms such as:
  • Microsoft Sentinel
    
  • Splunk
    
  • IBM QRadar
    
  • ArcSight
    
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, Carbon Black, or SentinelOne.