Cybersecurity Analyst II

Overview

Investigate and respond to complex, escalated, or high-impact cybersecurity events within a 24/7 Security Operations Centre (SOC), and act as an on-shift technical escalation point for Security Analyst I.

What you'll do

• Support a 24x7 Global SOC by responding to security events and maintaining visibility across the active alert queue.
• Lead the investigation and response of higher-impact or complex security incidents.
• Assess the scope, severity, and potential business impact of suspicious activity.
• Recommend and coordinate appropriate containment, remediation, and escalation actions in accordance with established procedures.
• Collaborate with incident response and relevant internal teams to support effective incident handling.
• Investigate and analyse alerts generated by security tools (EDR, NDR, SIEM) to identify potential security incidents.
• Correlate available evidence, develop investigation hypotheses, construct timelines, and identify potentially affected users or systems.
• Document investigation findings and provide detailed reports.
• Serve as an on-shift technical escalation point for junior analysts handling complex or unfamiliar security events.
• Review escalated investigations for completeness and accuracy and provide guidance on additional investigative steps.
• Communicate technical findings, security risks, and required actions clearly to relevant stakeholders.
• Support the coordination of evidence gathering, containment, remediation, and recovery activities.
• Provide structured handovers of ongoing investigations between SOC shifts, and review and accept cases transferred from previous shifts.
• Maintain appropriate ownership of investigations until resolution, escalation, or formal handover.
• Contribute to the development and maintenance of security documentation, procedures, playbooks, and incident response plans.
• Identify recurring false positives, detection gaps, and operational inefficiencies, and recommend improvements.
• Stay current with emerging threats, vulnerabilities, and industry best practices, and participate in training and development programmes.

What you'll need

• 3+ years of relevant experience in security operations, incident response, threat detection, or a comparable cybersecurity function.
• Demonstrated experience independently investigating security incidents, handling escalations, and supporting incident response activities.
• Experience working in globally distributed teams and collaborating across cultures, regions, functions, and time zones.
• Collaborative, team-oriented approach, working effectively with Security, Engineering, Product, Infrastructure, GRC, Privacy, Legal, and other business stakeholders.
• Excellent analytical and problem-solving abilities.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience demonstrating comparable knowledge and job skills.
• Strong understanding of cybersecurity principles, security monitoring, incident response, and security operations processes.
• Strong understanding of common cybersecurity threats, vulnerabilities, attack techniques, and adversary behaviour, applied during investigations.
• Proficient in security monitoring and investigation techniques, independently analysing alerts, correlating evidence, and determining appropriate response or escalation actions.
• Strong written and verbal communication skills in English, communicating findings, risks, status, and required actions to technical and non-technical stakeholders.

Nice to have

• Prior experience working in a 24x7 or shift-based Security Operations Centre environment.
• Intermediate-level cybersecurity certifications such as AZ-500, CySA+, GSOC, or GCIA.
• Experience with proactive threat hunting or advanced threat analysis.
• Previous experience acting as an Incident Coordinator, Incident Commander, or security incident lead.
• Familiarity with scripting or automation for security analysis and operational efficiency.
• Experience contributing to post-incident reviews, root-cause analysis, or lessons-learned activities.
• Familiarity with phishing investigation and advanced threat intelligence analysis.
• Experience contributing to security playbooks, procedures, or process-improvement initiatives.

Details

• Location: Bangalore, India.
• Works within a 24/7 SOC; candidates should be comfortable with rotational shifts, including nights, weekends, and public holidays.