L3 SOC Analyst

CubeLenz Solutions is seeking an experienced L3 SOC Analyst / Senior Security Incident Response Analyst to join their Security Operations team based in Rawalpindi. This onsite role requires a professional capable of managing high-severity security incidents from start to finish, including investigation, containment, eradication, and reporting to both technical teams and executive leadership. The position offers a competitive monthly salary of PKR 150,000 with shift timings from 8 AM to 4 PM CST (7 PM to 3 AM PKT). Candidates with 2 to 3 years of relevant experience are encouraged to apply, with immediate joiners preferred.

Key Responsibilities

Lead and conduct thorough investigations of high-severity incidents across multiple domains such as endpoints, identity systems, email, network, cloud, and SaaS telemetry. Develop comprehensive timelines and identify root causes rather than merely responding to alerts. Make informed containment decisions including session revocation, credential resets, host isolation, and network blocks, balancing business impact with security risks.

Execute eradication and recovery efforts to ensure complete removal of adversaries and persistence mechanisms such as OAuth grants, inbox rules, and scheduled tasks. Perform detailed log analysis and light forensics involving memory, disk, Microsoft 365/Entra audit logs, and network devices while preserving evidence suitable for legal and regulatory scrutiny.

Lead investigations involving protected health information (PHI) and personally identifiable information (PII), addressing unauthorized access, insider misuse, data exposure, and third-party risks. Assess the scope of data involved, access duration, and potential exfiltration, documenting findings to support HIPAA breach risk assessments. Collaborate closely with Privacy, Compliance, and Legal teams to assist in breach determinations, notifications, and remediation efforts. Contribute to strengthening data protection controls such as data loss prevention (DLP), access reviews, and secure file transfer protocols.

Manage incident communications by providing concise updates to the CISO and security leadership, delivering clear briefings to business stakeholders, and coordinating handoffs to IT, Legal, Privacy, and HR departments. Prepare incident reports and post-incident reviews that are accessible to both technical and non-technical audiences. Liaise with external partners including MDR/MSSP providers, forensic experts, cyber insurance representatives, and vendors as necessary.

Continuously improve detection capabilities by tuning SIEM rules and response playbooks to reduce false positives and shorten response times. Proactively conduct threat hunting using current intelligence and translate findings into actionable detections or hardening recommendations. Identify gaps in security controls such as offboarding processes, SSO/MFA coverage, mail-flow protections, and privileged access, driving remediation efforts with responsible teams.

Required Qualifications

- 2 to 3 years of hands-on experience in security operations or incident response, with a proven track record of leading high-severity investigations.
- Strong expertise in SIEM and detection engineering, including proficiency with KQL, SPL, or equivalent query languages, correlation logic, detection tuning, and log source onboarding.
- In-depth knowledge of identity and access management technologies such as Microsoft Entra ID/Active Directory, Conditional Access, MFA, OAuth grants, token/session abuse, privileged access, and offboarding controls.
- Experience with email security investigations including BEC and phishing analysis, email header/URL/attachment examination, mail-flow rules, DMARC/DKIM/SPF protocols, and secure email gateway tools.
- Endpoint security skills encompassing EDR investigation, response, persistence detection, and lateral movement analysis.

Key Tools & Technologies

Microsoft Sentinel, Splunk, Rapid7 InsightIDR, KQL/SPL, Microsoft Defender for Endpoint, CrowdStrike, Entra ID/Active Directory, Conditional Access & MFA, DMARC/DKIM/SPF, Secure Email Gateway.

This role offers the opportunity to work in a dynamic security operations environment, handling critical incidents and contributing to the continuous enhancement of organizational security posture. Immediate availability is highly preferred to meet urgent operational needs.