Security Analyst L3

As a Level 3 Security Analyst in a Managed Security Service Provider (MSSP), you are a senior member of the SOC responsible for leading complex investigations, responding to advanced threats, and providing strategic guidance on detection, response, and threat mitigation across multiple client environments. You will serve as a technical escalation point for Level 1 and Level 2 analysts, perform proactive threat hunting, and help shape SOC capabilities and detection strategies. This role combines deep technical expertise with strong leadership and communication skills in a high‑tempo, multi‑tenant security operations environment.

Key Responsibilities

• Lead investigation and incident response activities for high‑severity or complex security incidents across multiple clients.
• Act as final escalation point for incidents unresolved by Tier 1 and Tier 2 analysts.
• Conduct advanced forensic analysis of logs, network traffic, endpoints, and malware to identify root cause and scope.
• Perform proactive threat hunting based on current threat intelligence, TTPs (MITRE ATT&CK), IOCs, and anomalous behavior.
• Develop and refine detection logic, SIEM correlation rules, and EDR / NDR signatures to enhance SOC effectiveness.
• Support incident containment, eradication, and recovery efforts across diverse client environments.
• Collaborate with Threat Intelligence, Engineering, and IR teams to improve tools, data sources, and workflows.
• Identify gaps in an organization’s measurement metrics, telemetry, and logging capabilities and propose enhancement strategies to achieve the intended outcomes.
• Provide technical leadership and mentorship to junior analysts, supporting their skill development and analysis quality.
• Conduct post‑incident reviews and create root cause analysis (RCA) and after‑action reports for clients.
• Contribute to playbook creation, tuning, and automation efforts, particularly within SOAR platforms.
• Interface with client security teams, IT teams, and executives to communicate investigation findings, remediation guidance, and strategic improvements.
• Ensure SOC processes align with industry frameworks (e.g., NIST, ISO 27001) and client‑specific regulatory requirements (e.g., HIPAA, PCI‑DSS).
• Lead purple team exercises or internal red vs. blue simulations to test detection coverage and SOC readiness.

Requirements

Education & Experience :

Technical Skills :

Certifications (preferred) :

Seniority level

Mid‑Senior level

Employment type

Full‑time

Job function

Information Technology

Industries

Computer and Network Security

#J-18808-Ljbffr