Soc Analyst 2

Job Summary

We are seeking a highly analytical and experienced Senior SOC Analyst to join our proactive defense team. In this role, you will be the primary line of defense against cyber threats, responsible for advanced threat detection, incident response, and continuous monitoring. A critical component of this role involves deep-dive network analysis. You will leverage your extensive networking knowledge to investigate anomalies, analyze packet captures, and hunt for sophisticated threats traversing our infrastructure.

Key Responsibilities

• Advanced Threat Detection & Triage: Monitor, analyze, and investigate alerts from various security tools (SIEM, EDR, IDS/IPS, Firewalls) to identify malicious activity.
• Vulnerability Management: Drive the vulnerability lifecycle by conducting regular network and endpoint scans, assessing risk severity, and prioritizing remediation efforts. Identify infrastructure weaknesses and collaborate closely with IT and network teams to implement patches, compensating controls, and configuration changes.
• Network Traffic Analysis (NTA): Perform in-depth packet analysis (PCAP) and analyze network flow data to uncover command-and-control (C2) communications, data exfiltration, and lateral movement.
• Incident Response: Contain, eradicate, and recover from security incidents while maintaining meticulous chain-of-custody documentation.
• Threat Hunting: Proactively search for undetected threats within the network and endpoints using threat intelligence and hypothesis-driven methodologies.
• Mentorship: Guide and train junior SOC analysts on alert triage, network fundamentals, and incident escalation procedures.

Required Skills & Qualifications

• Experience: 3-5+ years of hands-on experience in a Security Operations Center or dedicated Incident Response role.
• Network Mastery: Deep, practical understanding of the OSI model, TCP/IP suite, routing protocols, and common network services.
• Network Tool Proficiency: Extensive experience with packet analysis tools (e.g., Wireshark, tcpdump,Zeek/Bro).
• OS Knowledge: Strong understanding of Windows and Linux operating system architectures, artifacts, and command-line interfaces.
• General SIEM/EDR Experience: Proven ability to navigate, query, and analyze data within enterprise SIEM and EDR platforms.

Preferred Skills (Good-to-Have)

• Microsoft Security Ecosystem: While we operate a diverse security stack, hands-on experience with Microsoft Sentinel (KQL querying, workbook creation) and Microsoft Defender XDR (endpoint, identity, cloud apps) is highly preferred.
• Scripting: Ability to write and understand scripts (Python, Bash, or PowerShell) for automation and data parsing.
• Firewall Familiarity: Experience reviewing logs and policies for Next-Gen Firewalls (e.g., Palo Alto, Fortinet, Cisco).

Education & Certifications

We highly value practical knowledge and industry-recognized certifications. Candidates possessing one or more of the following will be given strong preference:

• Core Cybersecurity & Operations: CompTIA Security+ (Sec+) and CompTIA Cybersecurity Analyst (CySA+)
• Applied Defensive Skills: Security Blue Team Level 1 (BTL1) or Offensive Security Defense Analyst (OSDA)
• Incident Response: GIAC Certified Incident Handler (GCIH)
• Networking Foundation: Cisco Certified Network Associate (CCNA)