SOC L2 Analyst

We're looking for an experienced security professional to join our SOC team — someone who has been in the trenches of a SOC environment, is confident handling complex incidents independently, and is ready to take on a more senior, analytical role.

As an SOC L2 Analyst, you will provide in-depth investigation and response for security incidents escalated from the L1 team. You'll take ownership of complex threats, conduct root cause analysis, proactively hunt for emerging risks, optimize our detection tooling, and help mentor junior analysts — playing a pivotal role in keeping our clients' environments secure.

Key responsibilities

Incident analysis and response

Conduct deep-dive investigations of escalated incidents, perform root cause analysis, and lead remediation efforts — escalating to L3 when required.

Threat hunting

Proactively identify threats and vulnerabilities by detecting patterns and anomalies in the environment before they escalate into major incidents.

Playbook and process optimization

Refine incident response playbooks based on lessons learned, and collaborate with L1 analysts to improve escalation procedures.

Security tool tuning

Configure and tune SIEM, EDR, and NDR tools to improve alert accuracy, reduce false positives, and enhance real threat detection.

Requirements

• S1 (Bachelor's) in Cybersecurity, Computer Science, IT, or related field
• Min. 2 years in a SOC environment, preferably as an L1 or L2 analyst
• Log analysis and investigation using SIEM, EDR, XDR, NDR, and firewalls
• Strong understanding of cyberattack techniques and MITRE ATT&CK framework
• Experience with Threat Intelligence Platforms (TIP) for global threat mapping

Cybersecurity certification (either of the following)

• EC-Council: CEH (Certified Ethical Hacker)/ECIH (EC-Council Certified Incident Handler)
• CompTIA: CySA+ (Cybersecurity Analyst)/Security+/CASP+
• Ability to read and understand technical literature in English

Additional requirements (good but not compulsory)

VAPT (Vulnerability Assessment & Penetration Testing) capabilities are a plus