SOC Analyst II

About the role

The SOC Analyst L2 is responsible for investigating and responding to complex cybersecurity incidents escalated from Level 1 analysts. The role performs advanced analysis, validates security events, coordinates containment activities, and supports incident response while contributing to threat hunting and detection improvements.

Responsibilities

Operations

• Perform detailed investigation of escalated security alerts.
• Analyze endpoint, network, cloud, and identity-related security events.
• Validate indicators of compromise (IOCs) and determine incident severity.
• Coordinate containment and recovery activities with technology teams.
• Execute incident response procedures for malware, phishing, ransomware, credential compromise, insider threats, and cloud security incidents.
• Collect and preserve forensic evidence where required.
• Document investigations and maintain complete case records.
• Perform threat intelligence enrichment.
• Identify attacker tactics, techniques, and procedures (TTPs).
• Map incidents to the MITRE ATT&CK framework.
• Recommend new detection opportunities based on investigations.
• Identify false positives and recommend SIEM tuning.
• Support development and validation of detection use cases.
• Participate in threat hunting exercises and purple team activities.
• Escalate high-severity incidents to L3/Incident Response teams.
• Work closely with Detection Engineering, SIEM Engineering and IT Operations teams.
• Prepare detailed incident reports.
• Update knowledge articles and operational runbooks.
• Participate in post-incident reviews and lessons learned sessions.

Required Qualifications

• Bachelor’s degree in computer science, Cybersecurity, Information Technology or a related field.
• 2+ years of experience in a Security Operations Center.
• Experience with enterprise SIEM, EDR/XDR, and incident response.
• Preferred Certifications - GCIH, GCIA, CompTIA Security+, Microsoft SC-200, Splunk Core Certified Power User or equivalent, CySA+.
• Technical Skills - SIEM platforms (Splunk), EDR/XDR technologies, Windows, Linux and Active Directory security, Cloud security (Azure, AWS, or Google Cloud), Network security fundamentals, Malware analysis basics, Threat intelligence, Log analysis, MITRE ATT&CK, Basic scripting (PowerShell or Python).