SOC Analyst - Tier 2

The SOC Analyst - Tier 2 is responsible for advanced security monitoring, incident investigation, threat analysis, and detection engineering activities within the company's Security Operations Center (SOC). The role serves as the primary escalation point for security incidents identified by L1 analysts and plays a critical role in validating threats, conducting investigations, and supporting incident response activities across enterprise, government, and critical infrastructure environments.

Responsibilities

• Investigate and analyze security incidents escalated by SOC L1 analysts.
• Validate security events and determine scope, impact, severity, and business risk.
• Perform advanced correlation and analysis of logs, alerts, network activity, endpoint telemetry, and threat intelligence.
• Conduct root cause analysis of security incidents and identify indicators of compromise (IOCs).
• Support incident containment, eradication, and recovery activities.
• Escalate incidents requiring specialized investigation or incident response support.
• Perform proactive threat hunting activities to identify malicious activity that may bypass automated controls.
• Utilize threat intelligence sources to identify emerging threats and attacker tactics.
• Analyze attack patterns, indicators, and behaviors associated with malware, ransomware, insider threats, and advanced persistent threats (APTs).
• Identify opportunities to improve detection coverage across monitored environments.
• Develop, tune, and optimize SIEM use cases and correlation rules.
• Support creation and maintenance of detection logic, dashboards, reports, alerts, and monitoring workflows.
• Reduce false positives through tuning and rule optimization.
• Support onboarding and integration of new log sources.
• Maintain detailed incident records and investigation documentation.
• Prepare technical analysis and incident reports.
• Support operational metrics, reporting, and service reviews.
• Ensure incident handling activities comply with established procedures and SLAs.
• Provide guidance and mentoring to L1 SOC Analysts.
• Support analyst development through coaching and technical knowledge sharing.
• Participate in continuous improvement initiatives and SOC maturity programs.
• Contribute to process, playbook, and procedure development.

Requirements

• Minimum 3 years experience in managed cybersecurity / SOC operations at an investigative level.
• Strong SIEM investigation, detection-rule development, log and network analysis, and use-case tuning.
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Engineering, or a related field.
• Security +, GCIA, GCIH certification preferred.