Microsoft Sentinel SOC Specialist (L3)

Req: Microsoft Sentinel SOC Specialist (L3)

Location: New Jersey area preferred

Role: Microsoft Sentinel SOC Specialist L3

Work Mode: Onsite

Job Requirements

• Strong hands-on experience with Microsoft Sentinel for SIEM monitoring, security analytics, incident investigation, and threat detection.
• Experience working as an L3 SOC Analyst/Specialist, handling complex security incidents, escalations, root-cause analysis, and advanced threat investigations.
• Expertise in Microsoft Defender XDR, including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud.
• Strong knowledge of KQL (Kusto Query Language) for developing advanced queries, detection rules, hunting queries, workbooks, and analytics rules.
• Experience designing, tuning, and maintaining Sentinel Analytics Rules, Workbooks, Automation Rules, Playbooks, Watchlists, and Data Connectors.
• Strong understanding of MITRE ATT&CK, threat hunting, IOC/IOA analysis, malware analysis, and security event correlation.
• Experience investigating phishing, ransomware, malware, credential compromise, insider threats, lateral movement, privilege escalation, and data exfiltration.
• Hands-on experience with SOAR automation using Microsoft Sentinel Playbooks and Azure Logic Apps.
• Ability to perform advanced threat hunting, identify anomalous behavior, correlate events across multiple data sources, and develop new detection use cases.
• Experience integrating Sentinel with Azure, Active Directory/Entra ID, Microsoft 365, firewalls, EDR/XDR, network devices, and third-party security tools.
• Strong understanding of TCP/IP, DNS, HTTP/S, authentication protocols, Windows/Linux security, Active Directory, and cloud security concepts.
• Experience with incident response processes, SOC procedures, SIEM use-case development, alert tuning, false-positive reduction, and security monitoring.
• Ability to create detailed incident reports, investigation documentation, executive summaries, and technical recommendations.
• Strong communication and troubleshooting skills with the ability to mentor L1/L2 SOC analysts and coordinate with incident response, infrastructure, cloud, and application teams.
• Microsoft Sentinel / SC-200 certification or relevant Microsoft security certifications are preferred.
• Must be willing to work onsite in the New Jersey area.