threat detection analyst

Tata Consultancy Services (TCS)

<div></div><div><div><div><div><ul><li>Managing and protecting an organization's Microsoft 365 environment from email and collaboration-based threats through the configuration and monitoring of the Microsoft Defender for Office 365 service. Responsibilities include threat detection, incident response, policy management, and technical support to safeguard against phishing, malware, and other advanced attacks</li>
<li>Defender for Cloud Apps role requires a candidate to manage, monitor, and protect cloud applications from threats, with responsibilities including discovering apps, managing their security posture, implementing data loss prevention, and responding to security alerts. Key skills include experience with cloud security tools, threat detection, security policy development, and analyzing security risks</li>
</ul></div></div></div><div><div><div><b>Location</b></div>
<div>Hyderabad</div>
</div><div><div><b>Job Function</b></div>
<div>TECHNOLOGY</div>
</div><div><div><b>Role</b></div>
<div>Assistant</div>
</div><div><div><b>Job Id</b></div>
<div>402935</div>
</div><div><div><b>Desired Skills</b></div>
<div>Microsoft Defender for Endpoint | Cyber Security | Symantec Endpoint Security</div>
</div></div><p>Desired Candidate Profile
</p><div><div><b>Qualifications</b> : BACHELOR OF COMMERCE, BACHELOR OF COMPUTER APPLICATION, BACHELOR OF COMPUTER SCIENCE, BACHELOR OF ENGINEERING</div></div></div><div></div>

Defender Admin

Cyber Force

<div>Cairo, Egypt Hybrid Full-time</div>
<br><div><h2 class="jobSectionHeader"><b>About Cyber Force</b></h2>
<p>
Cyber Force is a cybersecurity consultancy delivering advisory, managed services, and operations to international clients. Our senior-led teams combine governance, engineering, and 24&times;7 response to turn cyber risk into measurable resilience.</p>
<h2 class="jobSectionHeader"><b>
Role Overview</b></h2>
<p>
We are looking for a Junior Cyber Defense Operations Analyst to join our Threat Detection &amp; Response team as a frontline defender. You will monitor, triage, and investigate security alerts across SIEM, EDR, and XDR platforms, perform initial incident analysis, escalate confirmed threats, and maintain shift-based coverage for our managed services clients and on-site engagements. You will also leverage AI-augmented tooling and agentic SOC capabilities that Cyber Force is actively building into its detection and response workflows.</p>
<h2 class="jobSectionHeader"><b>
Key Responsibilities</b></h2>
<ul><li>Monitor security alerts from SIEM (Elastic SIEM, Microsoft Sentinel), EDR/XDR (Defender XDR) across client environments</li>
<li>Triage and investigate alerts: analyze log data, correlate events, identify IOCs, determine true vs. false positives</li>
<li>Perform initial incident response: collect artifacts, preserve evidence, escalate to Tier 2/3 with structured handoff</li>
<li>Execute detection playbooks aligned with MITRE ATT&amp;CK</li>
<li>Analyze network traffic, endpoint telemetry, and identity/authentication logs</li>
<li>Maintain shift logs, case notes, and client-facing incident reports to SLA standards</li>
<li>Contribute to detection engineering: propose rule improvements, tune thresholds</li>
<li>Leverage AI-augmented tooling and LLM-based tools (Claude, ChatGPT) for alert enrichment and report drafting</li>
<li>Validate AI-generated investigation outputs from agentic SOC capabilities</li>
<li>Participate in purple team exercises and continuous training</li>
</ul><h2 class="jobSectionHeader"><b>Requirements</b></h2>
<ul><li>Bachelor&rsquo;s in CS, Cybersecurity, IT, or related (or equivalent practical experience)</li>
<li>0&ndash;1 year experience in SOC, cyber defense, or IT security (internships, labs, CTFs count)</li>
<li>At least one cert: CompTIA Security+, CySA+, BTL1, ISACA CCOA, or equivalent</li>
<li>Fluent English (written and spoken)</li>
<li>Foundational knowledge of SIEM, EDR/XDR, and log analysis</li>
<li>Networking fundamentals: TCP/IP, DNS, HTTP/S, firewalls, proxies, VPNs</li>
<li>Familiarity with MITRE ATT&amp;CK and common adversary TTPs</li>
<li>Demonstrated experience using LLM-based tools (Claude, ChatGPT) &mdash; this is a must</li>
<li>Willingness to work rotating shifts (24/7 coverage) and deploy to client sites</li>
<li>Elastic, Microsoft Sentinel, or Defender XDR experience &mdash; a strong plus</li>
<li>VICI VCDA (Viridian Certified Defense Associate) certification &mdash; a plus</li>
<li>French language skills &mdash; a plus</li></ul></div>
<br><div><h4 class="jobSectionHeader"><b>Role details</b></h4>
<div>Location Cairo, Egypt
</div><div>Type Full-time
</div><div>Mode Hybrid</div></div>

Junior Cyber Defense Operations Analyst

The Home Depot

<div><div><p><b>Position Purpose:</b></p><p>
Protecting what matters most to our associates and consumers by securing our sensitive data and critical assets from current and emerging threats. At The Home Depot Cybersecurity consists of Architecture, Governance, Identity &amp; Access Management, Internal Threat Operations, Issue and Compliance Management, Risk Assessment/Advisory, Security Consulting, Security Operations, Service Optimization and Strategic Planning<br>
Analysts II perform data gathering, analysis, synthesis and develop solutions to support THD Cybersecurity practices.</p><p><b><br>
Key Responsibilities:</b></p><ul><li>
60% Analysis - Synthesize data to develop a solution, communicate the solution to stakeholders Analyze problems, structure the issue and perform analysis</li><li>
10% Collaborate - Partner cross-functionally to identify trends and resolve issues</li><li>
30% Drive Execution - Ensure initiative/project goals are met in a timely manner Implement solutions to meet customer expectations</li></ul><p><b><br>
Direct Manager/Direct Reports:</b></p><ul><li>
This Position typically reports to Manager or Sr. Manager</li><li>
This Position has 0 Direct Reports</li></ul><p><b><br>
Travel Requirements:</b></p><ul><li>
Typically requires overnight travel less than 10% of the time.</li></ul><p><b><br>
Physical Requirements:</b></p><ul><li>
Most of the time is spent sitting in a comfortable position and there is frequent opportunity to move about. On rare occasions there may be a need to move or lift light articles.</li></ul><p><b><br>
Working Conditions:</b></p><ul><li>
Located in a comfortable indoor area. Any unpleasant conditions would be infrequent and not objectionable.</li></ul><p><b><br>
Minimum Qualifications:</b></p><ul><li>
Must be eighteen years of age or older.</li><li>
Must be legally permitted to work in the United States.</li></ul><p><b><br>
Preferred Qualifications:</b></p><p>
Technical SME &amp; Platform Mastery</p><ul><li>
TMX Expert: Advanced experience configuring ThreatMetrix (LexisNexis), specifically Policy Engine rules, SmartID, and the Digital Identity Graph.</li><li>
Policy Lifecycle: Proven track record of managing Champion/Challenger testing and deploying production-ready fraud policies.</li><li>
Threat Detection: Deep knowledge of session attributes (Device ID, TrueIP, Bot Detection) to mitigate ATO and Synthetic Identity risk.</li><li>
Engineering Liaison: Experience translating security requirements into technical specifications for Online Engineering teams.</li></ul><p></p><p>
Analytics &amp; Performance Tuning</p><ul><li>
Strong Analytics: Proficiency in SQL or Python to analyze large datasets for emerging fraud patterns and rule effectiveness.</li><li>
Optimization: Ability to perform impact analysis to maximize Fraud Capture while maintaining a low False Positive rate.</li><li>
Reporting: Experience building TMX performance dashboards (e.g., Tableau, PowerBI) for executive-level reporting.</li></ul><p></p><p><b>
Minimum Education:</b></p><ul><li>
The knowledge, skills and abilities typically acquired through the completion of a bachelor's degree program or equivalent degree in a field of study related to the job.</li></ul><p><b><br>
Preferred Education:</b></p><ul><li>
No additional education</li></ul><p><b><br>
Minimum Years of Work Experience:</b></p><ul><li>
2</li></ul><p><b><br>
Preferred Years of Work Experience:</b></p><ul><li>
No additional years of experience</li></ul><p><b><br>
Minimum Leadership Experience:</b></p><ul><li>
None</li></ul><p><b><br>
Preferred Leadership Experience:</b></p><ul><li>
None</li></ul><p><b><br>
Certifications:</b></p><ul><li>
None</li></ul><p><b><br>
Competencies:</b></p><ul><li>
Action Oriented</li><li>
Collaborates</li><li>
Communicates Effectively</li><li>
Customer Focus</li><li>
Drives Results</li></ul></div><p></p><p><br>
Apply End Date: 06/22/2026</p></div>

Cybersecurity Analyst II (Remote)

cFocus Software Incorporated

<div><h1 class="jobSectionHeader"><b>Cyber Threat Intelligence Analyst Job Description</b></h1><b>
Position: </b>Cyber Threat Intelligence Analyst<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services.<br>
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul><p>
</p><p>Pw75tUj9Bf</p></div>

SBA - Cyber Threat Intelligence Analyst

Qiddiya Investment Company

<div><p>Qiddiya Investment Company is seeking an experienced and strategic Manager - Cybersecurity Threat Management to lead our threat management initiatives. In this leadership role, you will be responsible for overseeing the detection, analysis, and mitigation of cybersecurity threats to safeguard the organization's critical information assets and infrastructure.</p><p>
You will drive the development and execution of advanced threat intelligence programs and incident response strategies, collaborating with various teams to ensure a proactive and effective security posture.</p>
Key Responsibilities<ul>
<li>Lead the cybersecurity threat management program, including threat intelligence collection, analysis, and dissemination.</li>
<li>Oversee incident detection and response activities, ensuring timely and effective handling of security incidents.</li>
<li>Develop and implement advanced threat hunting and mitigation strategies tailored to organizational risks and needs.</li>
<li>Collaborate with internal and external stakeholders to enhance threat intelligence sharing and coordination.</li>
<li>Manage and mentor the cybersecurity threat management team, fostering skill development and knowledge sharing.</li>
<li>Prepare and present threat intelligence reports and risk assessments to senior leadership and stakeholders.</li>
<li>Stay abreast of emerging threats, tactics, and technologies, integrating new knowledge into threat management processes.</li>
<li>Ensure compliance with relevant cybersecurity standards, policies, and regulations.</li><br>
</ul><br>
<br>
<b>Requirements</b><br>
<ul>
<li>Bachelor's degree in Cybersecurity, Information Technology, or a related field.</li>
<li>6+ years of experience in cybersecurity threat management, incident response, or related fields.</li>
<li>Deep understanding of threat intelligence frameworks, security operations, and incident response methodologies.</li>
<li>Proven leadership and team management experience.</li>
<li>Familiarity with advanced threat detection tools and technologies.</li>
<li>Excellent analytical, communication, and interpersonal skills.</li>
<li>Relevant certifications such as Certified Information Systems Security Professional (CISSP), Certified Threat Intelligence Analyst (CTIA), or GIAC Certified Incident Handler (GCIH) are highly desirable.</li><br>
</ul><br>
<br>
<b>Benefits</b><p><br>
Comprehensive benefits package</p></div>

Manager - Cybersecurity Threat Management

Architecture In Motion

<div><p><b>Job Title: </b>SOC Analyst &ndash; Level 2</p>
<p><b>
Location:</b> Pakistan (Remote)</p>
<p><b>
Employment Type: </b>Full-time</p>
<p><b>
Work Model:</b> Remote (24/7 Shift Rotation)</p><p></p><p><b><br>
About Us:</b></p>
<p>
Arancia is a Canadian Cybersecurity Consulting, Advisory and Technology firm based in Mississauga, Ontario. Our team consists of geographically diverse professionals dedicated to solving complex cybersecurity challenges.</p>
<p>
Offering a robust set of services across the IT and Cybersecurity landscape, supported by our proprietary security platform DarkSense, Arancia delivers high-quality security solutions across industries such as Healthcare, Financial Services, and Critical Infrastructure to a global client base.</p>
<p>
Operating a modern 24/7 Security Operations Center, we combine advanced tooling with an evolving Agentic SOC platform to reduce noise, improve detection quality, and enable analysts to focus on meaningful investigations.</p>
<p>
If you are interested in working in a fast-paced, growing cybersecurity environment with a strong focus on innovation, investigation quality, and operational excellence, this role is for you.</p><p></p><p><b><br>
Job Summary:</b></p>
<p>
We are seeking a skilled and highly motivated SOC Analyst &ndash; Level 2 to join our Security Operations team. This role is ideal for someone with hands-on experience in SOC operations, threat investigation, and incident response.</p>
<p>
As an L2 SOC Analyst, you will take ownership of advanced triage and investigation of alerts escalated from L1, execute containment actions across customer environments, and drive detection quality through structured tuning and feedback loops.</p>
<p>
You will work closely with L1 analysts, Detection Engineering, Incident Response, and Threat Intelligence teams, as well as our Agentic SOC platform, to reduce dwell time and false positives. During evening shifts, you will also transition into proactive threat hunting, using dedicated time blocks to identify detection gaps and improve coverage.</p>
<p>
This role serves as a direct progression pathway into L3, Threat Hunting, Detection Engineering, or Incident Response.</p><p></p><p><b><br>
Key Responsibilities:</b></p>
<ul>
<li><b>Alert Triage &amp; Investigation:</b></li>
</ul>
<p>Perform advanced triage of alerts escalated from L1, determining true vs false positives. Investigate security events across endpoint, identity, network, and cloud telemetry. Correlate events and map adversary behavior to MITRE ATT&amp;CK while enriching findings with relevant threat intelligence context.</p>
<ul>
<li><b>Incident Response Execution:</b></li>
</ul>
<p>Execute or coordinate containment actions including host isolation (EDR), account disablement (Entra ID / IAM), and blocking indicators such as IPs, domains, or hashes. Partner with Incident Response teams on high-severity or multi-system incidents and document actions, timelines, and evidence with a clear chain of reasoning.</p>
<ul>
<li><b>Threat Hunting:</b></li>
</ul>
<p>Conduct hypothesis-driven threat hunting across endpoint, identity, and cloud datasets, particularly during evening shifts and on rotation. Convert hunt findings into new detections or tuning recommendations and maintain proper documentation of hunts and derived detections.</p>
<ul>
<li><b>Detection Quality &amp; Tuning:</b></li>
</ul>
<p>Provide structured feedback to Detection Engineering on false positives, detection gaps, and tuning opportunities. Validate new detection rules (Sigma, KQL, SPL, or equivalent) before production rollout and contribute to playbook authoring and continuous improvement.</p>
<ul>
<li><b>Case Management &amp; Reporting:</b></li>
</ul>
<p>Produce clear, complete incident reports suitable for both technical and non-technical stakeholders. Track and support SLA metrics including MTTD, MTTR, and MTTC. Participate in structured shift handovers and post-incident reviews.</p>
<ul>
<li><b>Collaboration &amp; Cross-Functional Teamwork:</b></li>
</ul>
<p>Collaborate closely with internal teams including Detection Engineering, Incident Response, and Threat Intelligence. Mentor L1 analysts on triage quality and investigation techniques, and contribute to internal knowledge bases and lessons-learned sessions.</p><p></p><p><b><br>
Qualifications:</b></p>
<ul>
<li><b>Experience:</b></li>
</ul>
<p>2&ndash;5 years of experience in a SOC, Incident Response, or equivalent hands-on blue team role. Demonstrable experience handling real security incidents end-to-end with a strong understanding of SOC workflows, escalation paths, and on-shift discipline.</p>
<ul>
<li><b>Industry Knowledge:</b></li>
</ul>
<p>Strong understanding of cybersecurity concepts including endpoint, network, identity, and cloud security. Solid grounding in MITRE ATT&amp;CK and its operational application in investigations.</p>
<ul>
<li><b>Technical Skills:</b></li>
</ul>
<p>Hands-on experience with at least one modern SIEM (Microsoft Sentinel, Elastic SIEM, OpenSearch, or similar) and at least one EDR solution (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or similar). Working knowledge of identity and cloud telemetry (Entra ID, Office 365, AWS/Azure logs). Proficiency in KQL is required; additional query languages such as SPL or OpenSearch DQL are a plus. Basic scripting in Python or PowerShell for automation and enrichment.</p>
<ul>
<li><b>Analytical &amp; Soft Skills:</b></li>
</ul>
<p>Strong investigative mindset with the ability to pivot across data sources and build timelines. Clear written communication suitable for customer-facing reports. Ability to remain calm under pressure during live incidents and shift transitions. Team-oriented with a willingness to mentor and continuously learn.</p>
<ul>
<li><b>Education:</b></li>
</ul>
<p>Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, or a related field (or equivalent practical experience).</p>
<ul>
<li><b>Certifications:</b></li>
</ul>
<p>Certifications such as BTL1, CySA+, GCIH, Microsoft SC-200, or CompTIA Security+ are considered a plus.</p><p></p><p><b><br>
Nice to Have:</b></p>
<p>
Exposure to SOAR platforms (Cortex XSOAR, Shuffle, Tines), threat intelligence platforms (MISP, OpenCTI), malware analysis or sandboxing tools (Any.Run, Joe Sandbox, Cuckoo), network detection tools (Zeek, Suricata), and cloud security experience across Azure, AWS, or GCP.</p><p></p><p><b><br>
Shift Details:</b></p>
<p>
This role operates on a 24/7 rotating schedule including day, evening, and night shifts. Evening shifts follow a hybrid structure combining live queue work with scheduled threat hunting blocks. Structured handovers are conducted at every shift change to ensure continuity on active incidents. Shift allowances apply for evenings, nights, weekends, and public holidays.</p><p></p><p><b><br>
Onboarding (First 30 Days):</b></p>
<ul>
<li><b>Days 1&ndash;15 &mdash; Shadowing:</b><br>
Pair with senior analysts across shifts to observe live investigations, understand playbooks, tooling, customer environments, and escalation thresholds. No production alert ownership during this phase.</li>
<li><b>Days 16&ndash;30 &mdash; Supervised Queue:</b><br>
Take ownership of alerts under direct supervision. All cases are reviewed with structured feedback on triage decisions, incident response actions, and reporting quality.</li>
<li><b>Day 30+ &mdash; Full Ownership:</b><br>
Independently manage the queue, continue shadowing complex incidents, and rotate into threat hunting responsibilities.</li></ul><br>
<p></p>
<p><b>
What a Typical Shift Looks Like:</b></p>
<p>
Start by reviewing handover notes, open incidents, and any ongoing hunts. Work through the escalation queue by triaging, investigating, containing, and documenting incidents. During evening shifts, execute scheduled hunts or deep-dive into complex investigations. End the shift by updating case notes, preparing a clear handover, and flagging detection tuning opportunities.</p><p></p><p><b><br>
Why Join Us:</b></p>
<ul>
<li>Modern SOC stack and tooling</li>
<li>Agentic SOC platform enabling AI-assisted triage and investigations</li>
<li>Clear career progression into L3, Threat Hunting, Detection Engineering, or IR</li>
<li>Structured onboarding and continuous learning support</li>
<li>Investigation-led culture focused on quality over ticket volume</li></ul><br>
<p></p>
<p><b>
Hours:</b></p>
<p>
40 hours per week (shift-based schedule)</p><p></p><p><b><br>
Compensation:</b></p>
<p>
Market competitive salary based on experience &amp; qualifications.</p></div>

SOC Analyst - Level 2

PROZ TECHNOLOGIES

<p><b>Job Title:</b> SOC L2 Analyst (OT Security)<br/><b>Location:</b> Doha, Qatar (On-site)</p><p>About the Role</p><p>We are looking for an experienced <b>SOC L2 Analyst</b> to join a leading Security Operations Center (SOC) team in Qatar. The role focuses on <b>advanced threat monitoring, incident investigation, and response</b> across both IT and <b>Operational Technology (OT)</b> environments.</p><p>This is an excellent opportunity for cybersecurity professionals with strong <b>SIEM and incident handling experience</b>, especially those with exposure to <b>industrial/OT security systems</b>.</p><p>Key Responsibilities</p><ul><li>Investigate and analyze <b>security alerts and incidents</b>, including escalations from L1 analysts</li><li>Perform <b>in-depth threat analysis</b> across IT and OT environments</li><li>Act as an <b>incident responder</b> for security events and recommend remediation actions</li><li>Monitor and manage <b>SIEM alerts, logs, and SOC tickets</b> within SLA timelines</li><li>Escalate critical incidents to L3/Senior Analysts when required</li><li>Support and mentor <b>junior SOC analysts (L1)</b></li><li>Collaborate with internal teams to improve <b>threat detection and response capabilities</b></li><li>Contribute to SOC documentation, runbooks, and knowledge base</li></ul><p>Required Skills &amp; Experience</p><ul><li>Minimum <b>5+ years of experience</b> in SOC / Cybersecurity operations</li><li>Strong experience with <b>SIEM tools</b> (Splunk, QRadar, ArcSight, Azure Sentinel, etc.)</li><li>Hands-on experience in <b>incident detection, investigation, and response</b></li><li>Strong knowledge of <b>network security, logs, and attack patterns</b></li><li>Experience with security tools such as <b>EDR, IDS/IPS, Firewalls, Vulnerability Scanners</b></li><li>Familiarity with <b>MITRE ATT&amp;CK framework</b></li><li>Good understanding of <b>Windows, Linux, and network environments</b></li></ul><p>Preferred (Nice to Have)</p><ul><li>Experience with <b>OT / ICS / SCADA security environments</b></li><li>Knowledge of protocols like <b>Modbus, DNP3, BACnet</b></li><li>Exposure to <b>industrial cybersecurity frameworks</b></li><li>Basic scripting knowledge (Python, PowerShell, Bash)</li></ul><p>Certifications (Preferred)</p><ul><li>SC-200, GCIH, CEH, or equivalent cybersecurity certifications</li><li>SIEM certifications (Splunk, Azure Sentinel, etc.)</li><li>OT Security certifications (e.g., Nozomi) are a plus</li></ul><p>Ideal Candidate</p><ul><li>SOC L2 Analyst / Senior Security Analyst</li><li>Experience working in <b>MSSP or enterprise SOC environments</b></li><li>Strong analytical and problem-solving skills</li><li>Ability to work in a <b>24x7 SOC environment</b></li></ul><p>Job Type: Permanent</p><p>Pay: Up to QAR15,000.00 per month</p><p>Work Location: In person</p>

SOC L2 Analyst (OT Security)

Search 2981+ Threat detection analyst jobs near you this May. New roles added regularly across leading industries. Apply today.