SOC Analyst- Tier 2 Investigation

Madre Integrated Engineering | Full time

• Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
• Perform detailed analysis of security events, logs, network traffic, and endpoint activities to identify malicious behavior.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) to determine the scope and impact of security incidents.
• Perform proactive threat hunting exercises using SIEM, EDR, and threat intelligence platforms.
• Investigate advanced threats, malware infections, phishing attacks, insider threats, and anomalous activities.
• Correlate events from multiple security tools to identify attack patterns and potential breaches.
• Develop and enhance use cases, detection rules, correlation logic, and SOC playbooks.
• Document investigation findings, root cause analysis, and incident reports.
• Collaborate with IT, infrastructure, network, and application teams during incident response activities.
• Support digital forensics activities and evidence collection when required.
• Participate in security incident response drills and continuous improvement initiatives.
• Mentor junior SOC analysts and provide technical guidance on complex investigations.

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 5-8 years of experience in Cyber Security Operations Center (SOC) environments.
• Minimum 3+ years of experience performing Tier 2 or advanced security investigations.
• Professional certification:
  • CompTIA CySA+ (Cybersecurity Analyst), or
  • GIAC Certified Intrusion Analyst (GCIA)
• Strong understanding of:
  • Security Incident Response
  • Threat Detection and Analysis
  • Network Security
  • Endpoint Security
  • Security Monitoring
  • Threat Intelligence
• Experience with enterprise SIEM platforms such as:
  • Microsoft Sentinel
  • Splunk
  • IBM QRadar
  • Arc Sight
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, Crowd Strike, Carbon Black, or Sentinel One.