Description
We are seeking a highly skilled L2 Security Analyst to join our dynamic Security Operations Center (SOC). In this role, you will be the technical escalation point for L1 analysts, responsible for advanced incident investigation, threat hunting, and security engineering within a hybrid environment. You will leverage your deep expertise in Splunk Enterprise Security, Google Chronicle, and Google Cloud Security Command Center (SCC) to detect, analyze, and respond to sophisticated cyber threats. This position is crucial for driving operational resilience by ensuring rapid response to alerts, continuously improving detection logic, and automating repetitive security tasks. You will perform proactive threat hunts, develop custom correlation searches, and create SOAR playbooks to enhance our security posture. Your contributions will directly impact our ability to protect critical on-premise and cloud infrastructures against emerging threats.
Requirements
1. Strong hands-on experience with Splunk Enterprise Security (ES), including advanced SPL queries and correlation search development.
2. Expertise in Google Chronicle SIEM and Google Cloud Security Command Center (SCC) for threat analysis.
3. Proven experience in L2 incident response, including root-cause analysis, containment, and eradication.
4. Demonstrated ability to perform proactive threat hunting using SIEM and EDR data.
5. Experience with SOC automation using Splunk SOAR (Phantom) or scripting languages like Python, PowerShell, or Bash.
6. Familiarity with operating and tuning EDR solutions such as Trellix EDR or Microsoft Defender for Endpoint.
7. Solid understanding of the MITRE ATT&CK framework and its application in detection engineering.
8. Working knowledge of cloud security principles and network protocols (TCP/IP, DNS, HTTP/S).
Desirable
1. Experience with BigQuery analytics for security use cases.
2. Relevant certifications such as Splunk Certified Power User/ES Analyst, Google Cloud Certified Security Engineer, or GCIH.
3. Experience mentoring junior analysts and tuning security use cases to reduce false positives.
4. Familiarity with compliance frameworks like ISO 27001, QCB, or NIA.
5. Knowledge of threat intelligence platforms (e.g., MISP) and integrating IoCs into detection tools.