Role Overview
We are seeking a skilled SOC Level 2 Analyst to support cybersecurity monitoring, threat detection, incident investigation, and response activities. The successful candidate will act as an escalation point for Level 1 analysts, perform detailed security investigations, and help improve the organization's security monitoring and detection capabilities.
Responsibilities
- Monitor and investigate security alerts from SIEM, EDR, NDR, Email Security, and Cloud Security platforms.
- Perform advanced analysis of security incidents, determine scope, impact, root cause, and remediation actions.
- Act as the primary escalation point for SOC Level 1 analysts.
- Conduct threat hunting activities to identify hidden or emerging threats.
- Analyze malware, phishing attempts, suspicious network activity, and endpoint compromises.
- Create and tune SIEM correlation rules and detection use cases.
- Develop incident reports and provide recommendations to reduce cyber risks.
- Collaborate with infrastructure, cloud, and application teams during incident response activities.
- Support digital forensics and evidence collection when required.
- Participate in vulnerability management and security improvement initiatives.
- Maintain SOC documentation, playbooks, and incident response procedures.
Requirements
- Bachelor's degree in Cybersecurity, Computer Science, Information Security, or related field.
- 4-7 years of cybersecurity experience.
- Minimum 2-4 years in a Security Operations Center (SOC) environment.
- Strong hands-on experience with:
- Microsoft Sentinel
- Splunk
- QRadar
- ArcSight
- CrowdStrike
- Microsoft Defender
- Palo Alto Networks
- Fortinet
- Good understanding of:
- Incident Response
- Threat Hunting
- Malware Analysis
- Network Security
- MITRE ATT&CK Framework
- Cyber Kill Chain
- TCP/IP, DNS, HTTP, Active Directory
- Windows and Linux Security
- Experience with cloud security monitoring (Azure, AWS, or Google Cloud) is preferred.
- Scripting knowledge in PowerShell or Python is an advantage.
Preferred Certifications
- CompTIA Security+
- CySA+
- GCIH
- GCIA
- SC-200
- SC-100
- CEH
- CISSP (preferred)
Must-Have Skills
- SOC L2 experience.
- SIEM investigation experience.
- Incident Response and Threat Hunting.
- Microsoft Sentinel or Splunk administration/investigation.
- EDR tools (CrowdStrike, Defender, SentinelOne).
- Log analysis and correlation.
- Ability to independently investigate security incidents and provide remediation recommendations.
