L2 SOC Lead

Job Description

You will be working as an L2 SOC Lead at CyberProof, a UST Company, dedicated to helping customers react faster and smarter to security threats. As part of the UST family, CyberProof is trusted by some of the worlds largest enterprises. Your role as an L2 SOC Lead will involve managing the existing shared services team and ensuring quality and defined processes globally.Key Responsibilities:- Work closely with SOC L1 team, L3 team, and customers to perform deeper analysis of security incidents- Handle escalated incidents from Level 1 team within SLA and advise L1 team members until incidents are resolved- Conduct deep analysis to identify the full kill chain of security incidents- Resolve L2 and above level technical escalations from L1 Operations team within SLA- Identify security gaps and recommend new rules/solutions to L3/Customer- Suggest finetuning for existing rules based on the high count/wherever required- Create and manage Incident handling playbook, process runbooks, and ad-hoc documents as needed- Respond to client requests, concerns, and suggestions- Support L1 team proactively during incidents- Perform and review tasks as identified in a daily task list- Work in a 24x7 rotational shift model, including night shifts- Incident detection, triage, analysis, and response- Coordinate with customers for security-related problems and provide solutions- Share knowledge with other analysts and provide knowledge transfer to L1 team- Assist in advanced hunting techniques, guides, cheat sheets, etc.Qualifications Required:- Experience managing L2 resources in a multi-location basis- Minimum 3 years of experience in Cybersecurity SOC- At least 2 years of experience working in a SOC- Proficiency in Incident Management and Response- Experience leading a team of more than 9 analysts- Proficient in at least 2 SIEM tools (Sentinel, QRadar, Splunk, LogRhythm, Google Chronicle)- Proficient in at least 2 EDR tools (CrowdStrike, MS Defender, Carbon Black, Cybereason, Sentinel One)- In-depth knowledge of security concepts, cyber-attacks, threat vectors, risk management, incident management, etc.- Up to date in cybersecurity and incidents; intermediate understanding of enterprise IT Infrastructure- Understanding of ISMS principles and guidelines, relevant frameworks (e.g., ISO27001)- Desired: Training/Certification in Ethical Hacking/SIEM Tool, etc.Additional Desired Skills:- Strong verbal and written English communication- Strong interpersonal and presentation skills- Ability to work with minimal levels of supervision- Essential: Knowledge and hands-on experience with Azure Sentinel, Microsoft 365 Defender, Microsoft Defender for Cloud Apps & Identity ProtectionNote: The job involves working in a 24x7 Security Operation Centre (SOC) environment. This role requires continuous learning, innovation, and optimization to suggest ideas for process improvement and reduce manual work. You will be expected to assist L1 team members whenever possible. You will be working as an L2 SOC Lead at CyberProof, a UST Company, dedicated to helping customers react faster and smarter to security threats. As part of the UST family, CyberProof is trusted by some of the worlds largest enterprises. Your role as an L2 SOC Lead will involve managing the existing shared services team and ensuring quality and defined processes globally.Key Responsibilities:- Work closely with SOC L1 team, L3 team, and customers to perform deeper analysis of security incidents- Handle escalated incidents from Level 1 team within SLA and advise L1 team members until incidents are resolved- Conduct deep analysis to identify the full kill chain of security incidents- Resolve L2 and above level technical escalations from L1 Operations team within SLA- Identify security gaps and recommend new rules/solutions to L3/Customer- Suggest finetuning for existing rules based on the high count/wherever required- Create and manage Incident handling playbook, process runbooks, and ad-hoc documents as needed- Respond to client requests, concerns, and suggestions- Support L1 team proactively during incidents- Perform and review tasks as identified in a daily task list- Work in a 24x7 rotational shift model, including night shifts- Incident detection, triage, analysis, and response- Coordinate with customers for security-related problems and provide solutions- Share knowledge with other analysts and provide knowledge transfer to L1 team- Assist in advanced hunting techniques, guides, cheat sheets, etc.Qualifications Required:- Experience managing L2 resources in a multi-location basis- Minimum 3 years of experience in Cybersecurity SOC- At least 2 years of experience working in a SOC- Proficiency in Incident Management and Response- Experience leading a team of more than 9 analysts- Proficient in at least 2 SIEM tools (Sentinel, QRadar, Splunk, LogRhythm, Google Chronicle)- Proficient in at least 2 EDR tools (CrowdSt

Keyskills :
Cyber securitySOCIncident ManagementRisk ManagementEthical HackingSIEM toolsEDR toolsISMS principlesISO27001Azure SentinelMicrosoft 365 Defender