L2 SOC Analyst

Saviynt's AI-powered identity platform manages and governs human and non-human access to all of an organization's applications, data, and business processes.

Customers trust Saviynt to safeguard their digital assets, drive operational efficiency, and reduce compliance costs.

Built for the AI age, Saviynt is today helping organizations safely accelerate their deployment and usage of AI.

Saviynt is recognized as the leader in identity security, with solutions that protect and empower the world’s leading brands, Fortune 500 companies and government institutions.

For more information, please visit www.saviynt.com .

We are building a next-generation Security Operations Center (SOC) designed for the AI-first era.

We are moving beyond traditional reactive methods to build an intelligent, automated SOC that leverages deep cloud security expertise to stop advanced threats.

We are seeking a motivated and detail-oriented L2 SOC Analyst to be a core member of our 24/7 operations team.

This role is for a hands-on analyst who excels at investigating complex alerts, using automation to accelerate response, and is passionate about cloud security.

You will be the primary line of in-depth analysis, working to validate, investigate, and contain threats as they are escalated from L1.

Please note: This is a 24/7 operational role.

The SOC team works in three rotating shifts (morning, afternoon, and night) to ensure continuous monitoring and response.

What You Will Be Doing Incident Triage & Investigation

• Serve as the primary escalation point for alerts triaged by L1 analysts.
• Conduct detailed analysis of security alerts from a wide range of sources (SIEM, EDR, CSPM, Cloud-native tools) to validate threats and determine their scope.
• Investigate security incidents in our enterprise and cloud environments (AWS, Azure, GCP), correlating data to build a complete picture of attacker activity.
• Perform deep-dive analysis of logs, kubernetes containers, and endpoint data to identify indicators of compromise (IOCs). Incident Response & Automation
• Execute and tune automated response playbooks using our SOAR platform for common security incidents.
• Perform timely incident response actions, such as isolating compromised hosts, blocking malicious IPs/domains, and disabling compromised accounts.