SOC L2 Specialist - (Saudi National Only)

About the Role
The SOC L2 Specialist is responsible for delivering the managed security operations service. This role handles escalated alerts from Level 1 analysts, leads incident response efforts, and supervises the day-to-day activities of the Security Operations Center (SOC).

Key Responsibilities

• Investigate and triage alerts escalated from Level 1 analysts, confirming or closing them with clear reasoning.
• Lead incident response, including containment, eradication, recovery, and root cause analysis.
• Perform deep-dive analysis of logs, network traffic, endpoint telemetry, and email threats.
• Tune SIEM correlation rules and use cases to minimize false positives.
• Conduct threat hunting based on threat intelligence and the MITRE ATT&CK framework.
• Create and maintain incident response playbooks and SOAR workflows.
• Supervise and mentor Level 1 analysts, review their work, and manage shift handovers.
• Write incident reports and present findings to both technical and management stakeholders.
• Report incidents in line with NCA requirements and the organization’s escalation matrix.
• Track SOC KPIs such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and Service Level Agreement (SLA) compliance.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, IT, or a related field.
• 4–6 years of experience in a SOC, with at least 2 years at the Level 2 level.
• Strong hands-on experience with SIEM tools (e.g., Splunk, IBM QRadar, Microsoft Sentinel, or similar).
• Experience with EDR/XDR solutions (e.g., CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms.
• Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics, and network protocols.
• Experience in an enterprise or managed SOC (MSSP) environment.
• Saudi national, fluent in Arabic and English.
• Willingness to support on-call or shift rotation as required.

Preferred Certifications

• GCIH
• GCIA
• CySA+
• CEH
• Splunk Core Certified Power User
• Microsoft SC-200
• IBM QRadar certification