XDR Analyst - L2

Roles & Responsibilities:
1.Handling alerts and incident on XDR platform
2.Alert & incident triage and analysis
3.Proactively investigating suspicious activities
4.Log all findings, actions taken, and escalations clearly in the XDR and ITSM platform
5.Execute predefined actions such as isolating blocking IPs or disabling user accounts, based on set protocols.
6.Adhere to established policies, procedures, and security practices.
7.Follow-up with tech team for incident closure
8.Participating in daily standup and review meeting
9.L2 Analyst has responsibility to closely track the incidents and support for closure.
10.Working with logsource and usecase management in integrating log sources and developing & testing usecase
11.Work & support on multiple cybersecurity tool (DLP, GRC, Cloudsec tool, DAM)
12.Developing SOP / instruction manual for L1 team
13.Guiding L1 team for triage/analysis and assist in clousure of cybersecurity alert and incidents
14.Handle XDR alerts and followup with customer team for agent updates
15.Escalate more complex incidents to L3 SME for deeper analysis.
Key Responsibilities:
Security Monitoring & Incident Response Governance
Define and maintain security monitoring, threat detection, and incident response policies and procedures.Establish and mature a threat intelligence program, incorporating tactical and strategic threat feeds.Align SOC operations with evolving business risk priorities and regulatory frameworks.Platform & Toolset Management
Evaluate, implement, and enhance SIEM platforms, ensuring optimal log ingestion, correlation, and rule effectiveness.Assess and manage deployment of EDR, XDR, SOAR, and Threat Intelligence solutions.Maintain and update incident response playbooks and automation workflows.Ensure consistent platform hygiene and technology stack effectiveness across SOC tooling.SOC Operations & Threat Detection
Oversee 24x7 monitoring of security events and alerts across enterprise assets.Lead and coordinate proactive threat hunting across networks, endpoints, and cloud.Manage and support forensic investigations to identify root cause and recovery paths.Govern use case development, log source onboarding, and alert/event triage processes.Regulatory Compliance & Incident Management
Ensure timely and accurate incident reporting in compliance with RBI, CERT-In, and other authorities.Retain logs in accordance with regulatory data retention mandates.Enforce and monitor security baselines for endpoints, in line with internal and regulatory standards.Advanced Threat Management & Reporting
Plan, conduct, and report on Red Teaming and Purple Teaming exercises to test detection and response capabilities.Participate in and contribute to the Risk Operations Committee (ROC) meetings and initiatives.Review and track SOC effectiveness through KPIs, metrics, and regular reporting dashboards.


Required education
Bachelor's Degree

Preferred education
Master's Degree

Required technical and professional expertise

Bachelor’s or Master’s degree in Cybersecurity, Computer Science, or related field.3-7 years of experience in SOC management, incident response, or cyber threat detection roles.Hands-on expertise with SIEM (e.g., Splunk, QRadar, Sentinel), EDR/XDR tools, and SOAR platforms.Proven experience in playbook development, forensics, and threat hunting methodologies.Strong understanding of RBI/CERT-In incident reporting guidelines and log retention requirements.Familiarity with MITRE ATT&CK, threat modeling, and adversary emulation techniques.


Preferred technical and professional experience

Preferred Certifications:
GCIA, GCIH, GCFA, CISSP, OSCP, CEH, CHFI, or similar certifications"