Cyber Security Analyst (SOC Level 2)

DWP Group · Lahore, Pakistan

We are looking for a skilled and proactive SOC Analyst - Level 2 to join our Cyber Security team. The ideal candidate will have hands‑on experience in SIEM, SOAR, Case Mangement, security incident investigation, threat analysis, and incident response.

Key Responsibilities

• Monitor, investigate, and respond to security incidents escalated from the SOC Level 1 team.
• Perform in-depth analysis of security events and alerts.
• Conduct incident triage, root cause analysis, and recommend appropriate containment, remediation, and recovery actions.
• Develop, optimize, and maintain SIEM/EDR use cases, correlation rules, dashboards, reports, and custom searches.
• Tune SIEM detection rules to minimize false positives and improve threat detection capabilities.
• Investigate complex security incidents involving Windows, Linux, Active Directory, firewalls, VPNs, IDS/IPS, endpoint security, and network logs.
• Coordinate with internal technical teams, customers, and third-party vendors during security incident investigations.
• Lead technical escalations and ensure timely incident resolution within agreed service levels (SLAs).
• Prepare incident reports, executive summaries, and periodic security reports for management and clients.
• Participate in customer meetings to discuss incident findings, security posture, and remediation recommendations.
• Maintain proper documentation, investigation evidence, and audit records to support compliance requirements.
• Assist in developing SOC playbooks, standard operating procedures (SOPs), and incident response workflows.
• Mentor SOC Level 1 analysts by providing technical guidance and knowledge sharing.
• Stay current with emerging cyber threats, attack techniques, threat intelligence, and industry best practices.

Qualifications:

• Bachelor's degree in Computer Science, Information Technology, Cyber Security, Software Engineering, or a related discipline.
• 2-3 years of experience in a Security Operations Center (SOC) environment.
• Hands‑on experience with IBM QRadar SIEM is mandatory.
• Experience in enterprise security monitoring, incident response, and threat analysis.
• Strong expertise in IBM QRadar SIEM, log analysis, event correlation, and use case development.
• Good understanding of Windows, Linux, Active Directory, firewall, VPN, IDS/IPS, endpoint security, and network log analysis.
• Basic scripting knowledge in Python or PowerShell will be an added advantage.
• Preferred Certifications: IBM Certified Associate Administrator - QRadar SIEM, CompTIA Security+, EC-Council Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH), Microsoft SC-200: Security Operations Analyst.