We are looking for a proactive and technically skilled SOC Level 2 Analyst to strengthen our Security Operations capabilities. As a key escalation point from L1, you will analyze, investigate, and escalate security s and events, working closely with threat intelligence and incident response teams.

Your mission: minimize dwell time, validate and enrich s, and contribute to continuous improvement of our detection and response strategies.

Key Responsibilities:

• Review and investigate escalated security events from SOC L1 analysts using SIEM, EDR, NDR, and other monitoring tools.

• Perform initial triage and validation of s, classify incidents, and escalate as needed to Incident Response or Threat Hunting teams.

• Leverage threat intelligence to contextualize s and correlate multiple sources of evidence. • Analyze suspicious activity across endpoints, networks, email, and cloud environments. • Document investigation steps, findings, and recommendations accurately and clearly. • Maintain and improve playbooks, runbooks, and standard operating procedures.

• Participate in purple team exercises, tabletop simulations, and detection engineering feedback loops.

• Collaborate with L1 analysts by providing guidance and training on detection logic and triage techniques.

Required Qualifications:

• 3+ years of experience in a SOC, security monitoring, or cybersecurity operations role.

• Strong familiarity with security technologies such as SIEM (e.g., Splunk, QRadar, Sentinel), EDR (e.g., CrowdStrike, Defender for Endpoint), firewall logs, proxy logs.

• Good understanding of common TTPs and attack models (MITRE ATT&CK, Cyber Kill Chain).

• Hands-on experience performing triage, threat classification, and incident escalation.

• Ability to write concise and accurate incident documentation and reports. • Working knowledge of Windows and Linux operating systems from a security perspective. Desired Qualifications:

• Familiarity with detection logic tuning, rule creation, and threat hunting principles.

• Experience with phishing investigations, malware sandboxing, and basic memory/network forensics. •

 Exposure to scripting (Python, Bash, PowerShell) to automate tasks and parse data.

• Knowledge of cloud security monitoring (Azure, AWS, Google Cloud).

• Certifications such as: Security+, CySA+, GCFE, GCIH, SC-200, or equivalent.

What We Offer:

• Work with skilled cybersecurity professionals in a collaborative SOC/IR environment.

• Structured career growth path to IR, Threat Hunting, or Detection Engineering.

• Access to paid certifications, tools, and labs.