L3 SOC Analyst

CubeLenz Solutions is seeking an experienced L3 SOC Analyst (Senior Security Incident Response Analyst) to join their Security Operations team based in Rawalpindi. This onsite role requires a professional capable of managing high-severity security incidents from start to finish—investigating, containing, eradicating threats, and reporting findings to both technical teams and executive leadership. The position operates on a shift from 8 AM to 4 PM CST (7 PM to 3 AM PKT) with a monthly salary of PKR 150,000. Candidates with 2 to 3 years of relevant experience are preferred, and immediate joiners will be given priority.

Key Responsibilities

Lead complex investigations involving endpoint, identity, email, network, cloud, and SaaS telemetry, constructing comprehensive timelines and root cause analyses beyond simple alert reviews. Make informed containment decisions such as session revocation, credential resets, host isolation, and network blocks while balancing business impact and risk. Conduct eradication and recovery efforts, ensuring adversaries are fully removed and persistence mechanisms like OAuth grants and MFA device registrations are eliminated.

Perform detailed log analysis and light forensics across various platforms including memory, disk, M365/Entra audit logs, and network devices, maintaining evidence integrity suitable for legal and regulatory scrutiny. Take charge of investigations involving protected health information (PHI) and personally identifiable information (PII), assessing unauthorized access, insider misuse, and third-party exposures. Document findings meticulously to support HIPAA breach risk assessments and collaborate with Privacy, Compliance, and Legal teams to guide breach determination and notification processes.

Own incident communications by providing clear, concise updates to the CISO and security leadership, briefing business owners in plain language, and coordinating handoffs to IT, Legal, Privacy, and HR departments. Prepare incident reports and post-incident reviews that are accessible to both technical and non-technical stakeholders. Manage coordination with external partners such as MDR/MSSP providers, forensic experts, cyber insurance, and vendors.

Continuously improve detection capabilities by tuning SIEM detections and response playbooks based on incident learnings to reduce false positives and containment time. Proactively threat hunt using current intelligence and translate findings into actionable detections or hardening recommendations. Identify and address control gaps related to offboarding, SSO/MFA coverage, mail-flow protections, and privileged access by collaborating with responsible teams.

Required Qualifications

2 to 3 years of hands-on experience in security operations or incident response, with proven ability to lead investigations on high-severity incidents. Strong practical knowledge in:

- SIEM and Detection Engineering, including proficiency with KQL, SPL, or similar query languages, correlation logic, detection tuning, and log source onboarding.
- Identity and Access Management, particularly Microsoft Entra ID/Active Directory, Conditional Access, MFA, OAuth/consent grants, token/session abuse, privileged access, and offboarding controls.
- Email Security, including investigation of BEC and phishing attacks, analysis of headers, URLs, attachments, mail-flow rules, and familiarity with DMARC, DKIM, SPF, secure email gateways, and API-based email security tools.
- Endpoint Security, with experience in EDR investigation, response, persistence detection, and lateral movement analysis.

Key Tools and Technologies

Experience with Microsoft Sentinel, Splunk, Rapid7 InsightIDR, KQL/SPL, Microsoft Defender for Endpoint, CrowdStrike, Entra ID/Active Directory, Conditional Access & MFA, DMARC/DKIM/SPF, and Secure Email Gateway solutions is essential.

This role offers an opportunity to work in a dynamic Security Operations environment where your expertise will directly contribute to protecting critical data and infrastructure. Immediate availability is highly desirable.