L3 SOC analyst & SOC Lead

Roles & Responsibilities

ROLE OVERVIEW

This is a senior role with L3 analyst responsibilities with hands-on SOC management, with the technical depth of an L3 makes you a better operations leader, and the management lens makes you a sharper threat hunter. You are the final escalation point for complex incidents, the owner of threat hunting and detection engineering, and the day-to-day leader of the L1/L2 analyst team. You are equally comfortable doing deep forensic analysis and chairing a client Quarterly Business Review. If you are a senior analyst ready to lead, or someone who refuses to step away from the tools, this role is built for you.

KEY RESPONSIBILITIES

A | Technical — L3 Analyst, Threat Hunting & DFIR

• Proactively hunt for threats across client SIEM, EDR/XDR, and network telemetry using MITREATT&CK-based hypotheses

• Build, tune, and maintain SIEM detection rules and SOAR playbooks; map coverage gaps against the ATT&CK matrix

• Lead complex incident response end-to-end — scoping, containment, eradication, recovery, and post-incident review

• Conduct host, memory(Volatility3), and network forensics to reconstruct attack timelines and identify attacker TTPs

• Triage malware samples using sandbox and static/dynamic analysis; extract IoCs and translate findings into detections

• Consume and operationalise threat intelligence feeds (MISP, commercial TIPs, open-source) across client environments

• Produce clear, accurate incident reports and post-incident reviews suitable for technical teams and client boards

• Mentor L1/L2 analysts on active cases and continuously raise the team's technical capability

B | Management — SOC Operations, Team & Clients

• Lead, develop, and performance-manage the L1 and L2 analyst team; conduct regular 1-to-1s and career development planning

• Manage shift rosters and handovers to maintain 24/7 monitoring coverage across all client environments

• Own client SLAs — track and report on MTTD, MTTA, MTTC, and MTTR; drive continuous improvement where targets are missed

• Develop and maintain SOC runbooks, IR playbooks, escalation procedures, and SOPs

• Act as incident commander during major incidents — coordinating response, managing client comms, and directing remediation

• Produce monthly client security reports and lead Quarterly Business Reviews (QBRs) with client stakeholders

• Oversee the SOC technology stack (SIEM, EDR, SOAR, TIP, ticketing) — licensing, health, configuration, and improvement

• Support pre-sales activities including SOC capability demonstrations and onboarding scoping for new clients

TECHNICAL SKILLS & KNOWLEDGE

• SIEM: Microsoft Sentinel(KQL), Splunk (SPL), IBM QRadar, or Elastic — advanced rule writing, not just usage

• EDR/XDR: TrendAI, CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne — deep investigative and hunting use

• SOAR: Playbook development in Splunk SOAR, Sentinel Logic Apps, Palo Alto XSOAR, or equivalent

• DFIR Tooling: Volatility3, Autopsy/FTK, Velociraptor, KAPE, plaso/log2timeline

• Network Forensics: Wireshark, Zeek, Suricata, NetFlow/IPFIX analysis

• Malware Analysis: Any.run /Cuckoo sandbox, PEStudio, YARA rules, basic static/dynamic analysis

• Frameworks: MITREATT&CK, NIST IR lifecycle, PICERL

• OS Forensics: Windows event logs (Security, Sysmon), registry, prefetch; Linux syslog, bash history

• Active Directory: AD attack paths (Pass-the-Hash, Kerberoasting, DCSync), BloodHound

• Cloud: AWS CloudTrail, Azure Activity/Sign-In Logs, M365 Unified Audit Log

• Scripting: Python or PowerShell for enrichment, automation, and IoC ingestion (advantageous)

COMPETENCIES & SOFT SKILLS

• Attacker mindset — you think like a threat actor to build better detections

• Calm and decisive under pressure; the team and clients look to you when things are serious

• Strong written communication — incident reports and executive summaries that are clear and genuinely useful

• Coaching mindset — you invest in L1/L2 development and take satisfaction in the team improving

• Commercially aware —understands that SOC performance is a business value driver, not just a technical exercise

• Adaptable — able to switch between deep forensic work and a client-facing QBR within the same day

EDUCATION & EXPERIENCE

Education

Bachelor's Degree in Cybersecurity, Computer Science, or IT. Diploma holders with strong hands-on experience at senior SOC level are equally considered.

Experience

5–7 years in security operations, with at least 2–3 years at L2/L3 level. Prior team lead, shift lead, or SOC lead experience is strongly preferred. MSSP experience across multiple client environments is a significant advantage.

PREFERRED CERTIFICATIONS

• GIAC GCIH
• GIAC GCIA
• GIAC GCFA
• GIAC GREM
• GIAC GSOC
• CISSP
• CISM
• CompTIA CySA+
• Microsoft SC-200
• Splunk Power User / Admin
• CompTIA SecurityX
• BTL2 / OSCP (Advantageous)

Tell employers what skills you have

Client-Server Environment
Recovery Procedures
Technical Analysis
Coverage Analysis
Flash Memory
Open Source
Tuning
Incident Reports
IoC
Design-Build
Telemetry
Containment Action
Threat Intelligence
Incident Handling
Network Forensics
Volatility