SOC L3 Analyst

5-10 Years

Save

Early Applicant

Job Description

Role Summary: Senior escalation point responsible for advanced threat detection, complex incident analysis, use‑case development, custom parsing, and guiding SOC maturity.
Key Responsibilities
Lead high‑severity incident investigations, threat hunting, and root‑cause analysis.
Perform deep log analysis across endpoint, network, cloud, identity, and application sources.
Develop custom log parsers for non‑standard log sources and ensure accurate telemetry ingestion.
Build and fine‑tune use cases, correlation rules, and behavioral detections aligned with MITRE ATT&CK.
Conduct proactive threat hunting and detection tuning to reduce false positives.
Provide guidance to L1/L2 teams and support playbook improvements.
Prepare technical and executive‑level incident reports and provide remediation guidance.
Required Skills
Strong expertise in EDR, SIEM, SOAR, and security telemetry analysis.
Advanced knowledge of incident response, malware behavior, cloud logs, network forensics, and identity analytics.
Skilled in YARA/Sigma/behavior-based detections and rule tuning.
Ability to correlate multi-source logs and reconstruct full attack chains.
Familiar with NCA, SAMA, ISO 27001, and MITRE ATT&CK frameworks.
Preferred Experience & Certifications
5–8+ years in SOC, DFIR, or detection engineering roles.
GIAC GCIA/GCIH/GCFA/GCTI, CISSP, CySA+, or equivalent.