L2 Security Analyst

Job Title - L2 Security Analyst

JOB DESCRIPTION

The L2 Security Analyst will be responsible for investigating, analysing and responding to security incidents across the organisation's security environment. The role requires hands-on experience with Microsoft Sentinel, CrowdStrike and Microsoft Defender, with a strong focus on threat detection, incident response and security monitoring.

Key Responsibilities

1. Security Monitoring & Incident Investigation

Monitor and investigate security alerts escalated from L1 SOC analysts.

Perform in-depth analysis of security events to identify potential threats, suspicious activities and indicators of compromise (IOCs).

Investigate complex security incidents and determine their scope, impact and severity.

Correlate security events across multiple sources to identify attack patterns.

2. SIEM – Microsoft Sentinel

Monitor and investigate security incidents using Microsoft Sentinel.

Develop, modify and optimise KQL queries for threat hunting and incident investigation.

Analyse logs and security events from endpoints, networks, cloud environments and Microsoft 365.

Support the development and tuning of analytics rules, workbooks and detection use cases.

3. Endpoint Security – CrowdStrike & Microsoft Defender

Monitor and investigate endpoint security alerts using CrowdStrike Falcon.

Perform endpoint threat analysis, malware investigation and suspicious process analysis.

Utilise Microsoft Defender for Endpoint to investigate threats, assess endpoint exposure and support incident containment.

Coordinate endpoint isolation, remediation and recovery activities.

Identify recurring endpoint threats and recommend preventive security measures.

4. Threat Hunting & Incident Response

Conduct proactive threat hunting to identify hidden or emerging threats.

Analyse IOCs, TTPs and attack patterns using MITRE ATT&CK.

Support incident containment, eradication and recovery.

Prepare detailed incident reports and recommend corrective actions.

5. Reporting & Escalation

Prepare incident investigation reports and maintain accurate case documentation.

Escalate critical security incidents to L3 or relevant stakeholders.

Support L1 analysts through technical guidance and knowledge sharing.

Contribute to continuous improvement of SOC processes and detection capabilities.

Required Technical Skills

Hands-on experience with Microsoft Sentinel (SIEM).

Strong practical experience with CrowdStrike Falcon (EDR).

Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.

Proficiency in KQL for security investigation and threat hunting.

Strong understanding of SIEM, EDR, XDR and SOC operations.

Knowledge of incident response, malware analysis and endpoint investigation.

Familiarity with MITRE ATT&CK framework and threat intelligence.

Understanding of Windows operating systems, Active Directory and network security fundamentals.

Qualifications & Experience

Bachelor's degree in Computer Science, Information Security, Cybersecurity or a related discipline.

3–5 years of experience in SOC operations or cybersecurity.

Minimum 2 years of hands-on experience in security monitoring and incident investigation.

Relevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ or equivalent are desirable.

Key Competencies

Strong analytical and problem-solving skills.

Ability to investigate and prioritise security incidents independently.

Good communication and technical reporting skills.

Ability to work in a 24/7 SOC shift environment, where required.

Strong attention to detail and ownership of incident resolution.

Required Technical Skills

Hands-on experience with Microsoft Sentinel (SIEM).

Strong practical experience with CrowdStrike Falcon (EDR).

Experience with Microsoft Defender for Endpoint and Microsoft security ecosystem.

Proficiency in KQL for security investigation and threat hunting.

Strong understanding of SIEM, EDR, XDR and SOC operations.

Knowledge of incident response, malware analysis and endpoint investigation.

Familiarity with MITRE ATT&CK framework and threat intelligence.

Understanding of Windows operating systems, Active Directory and network security fundamentals.

Qualifications & Experience

Bachelor's degree in computer science, Information Security, Cybersecurity or a related discipline.

5+ years of experience in SOC operations or cybersecurity.

Minimum 2 years of hands-on experience in security monitoring and incident investigation.

Relevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ or equivalent are desirable.

Apply now!