CYBER SECURITY ANALYST L4

Role Purpose

Experience and Domain

Security Operations and Incident Response

• Monitor and manage incidents and alerts in Microsoft Sentinel and Microsoft Defender XDR.
• Perform triage, investigation, containment, remediation, and closure of security incidents.
• Investigate compromised accounts, malware, ransomware, PowerShell, brute-force attacks, anomalous sign-ins, and endpoint threats.
• Support 24x7 SOC operations, shift handovers, escalations, and incident response processes.

Phishing and Email Security

• Investigate phishing, malicious email, spoofing, business email compromise, and credential-harvesting incidents.
• Analyze email headers, sender reputation, URLs, attachments, domains, IP addresses, and indicators of compromise.
• Perform email remediation and deletion using Mimecast and Microsoft Defender for Office 365.
• Develop phishing investigation procedures and coordinate mailbox and credential remediation.

SIEM and Threat Hunting

• Develop and tune Microsoft Sentinel analytics rules, KQL queries, workbooks, dashboards, watchlists, and custom detections.
• Troubleshoot data connectors and log ingestion across Entra ID, Azure, Defender, Mimecast, and network platforms.
• Conduct proactive threat hunting for malicious indicators, credential attacks, lateral movement, ransomware, and other techniques.
• Map detections and hunting activities to the MITRE ATT&CK framework.

Endpoint, Identity, and Cloud Security

• Investigate endpoint alerts, process trees, command lines, network connections, file activity, and user behavior with Microsoft Defender.
• Use endpoint containment, remediation, Live Response, and sensor health investigations.
• Investigate Entra ID authentication events, compromised identities, MFA activity, Azure resources, and cloud applications.
• Support security monitoring across Microsoft 365 and Azure environments.

Detection Engineering and SOC Leadership

• Design detections from threat intelligence, incidents, and MITRE ATT&CK techniques.
• Automate enrichment, notifications, incident handling, and other repetitive SOC activities with Logic Apps and Sentinel automation.
• Guide junior analysts, review investigations, maintain SOPs and playbooks, and track operational metrics.
• Support SOC transition, onboarding, operational readiness, knowledge transfer, and process improvement.

Core Technical Skills

• Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, and Mimecast.
• Microsoft Entra ID, Defender for Cloud Apps, Azure security, KQL, Defender Advanced Hunting, and Logic Apps.
• Threat intelligence, IOC analysis, MITRE ATT&CK, incident response, alert triage, detection engineering, and SOC monitoring.
• Azure Activity Logs, Log Analytics, Azure Diagnostics, network telemetry, Zscaler, Cloudflare, and endpoint security tools.

Certifications and Mandatory Skill

• Preferred certifications include Microsoft SC-200, SC-100, AZ-500, CEH, and other relevant SOC, SIEM, cloud security, or incident response certifications.
• The source lists Vulnerability Management as a mandatory skill.
• The source also lists 5–8 years of experience in a separate mandatory-skills section.

Company Description