SOC Analyst, L2

• Perform advanced triage of alerts escalated from L1 and determine true versus false positives
• Investigate security events across endpoint, identity, network, and cloud telemetry
• Correlate events and map adversary behavior to MITRE ATT&CK
• Enrich findings with relevant threat intelligence context
• Execute or coordinate containment actions, including host isolation, account disablement, and blocking IPs, domains, or hashes
• Partner with Incident Response teams on high-severity or multi-system incidents
• Document actions, timelines, evidence, and reasoning
• Conduct hypothesis-driven threat hunting across endpoint, identity, and cloud datasets
• Convert hunt findings into new detections or tuning recommendations
• Provide structured feedback to Detection Engineering on false positives, detection gaps, and tuning opportunities
• Validate new detection rules using Sigma, KQL, SPL, or equivalent before production rollout
• Contribute to playbook authoring and continuous improvement
• Produce incident reports for technical and non-technical stakeholders
• Track and support SLA metrics including MTTD, MTTR, and MTTC
• Participate in shift handovers and post-incident reviews
• Collaborate with Detection Engineering, Incident Response, and Threat Intelligence teams
• Mentor L1 analysts on triage quality and investigation techniques
• Contribute to internal knowledge bases and lessons-learned sessions
• Review handover notes, open incidents, and ongoing hunts at the start of each shift
• Independently manage the queue after onboarding and rotate into threat hunting responsibilities

• 2–5 years of experience in a SOC, Incident Response, or equivalent hands-on blue team role
• Demonstrable experience handling real security incidents end-to-end
• Strong understanding of SOC workflows, escalation paths, and on-shift discipline
• Strong understanding of endpoint, network, identity, and cloud security
• Solid grounding in MITRE ATT&CK and its operational application in investigations
• Hands-on experience with at least one modern SIEM, such as Microsoft Sentinel, Elastic SIEM, or OpenSearch
• Hands-on experience with at least one EDR solution, such as Microsoft Defender for Endpoint, CrowdStrike, or SentinelOne
• Working knowledge of identity and cloud telemetry, including Entra ID, Office 365, and AWS/Azure logs
• Proficiency in KQL is required
• Basic scripting in Python or PowerShell for automation and enrichment
• Strong investigative mindset and ability to pivot across data sources and build timelines
• Clear written communication suitable for customer-facing reports
• Ability to remain calm under pressure during live incidents and shift transitions
• Team-oriented with willingness to mentor and continuously learn
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience
• Availability for a 24/7 rotating schedule including day, evening, and night shifts
• Ability to work 40 hours per week on a shift-based schedule
• Certifications such as BTL1, CySA+, GCIH, Microsoft SC-200, or CompTIA Security+ are considered a plus
• Exposure to SOAR platforms, threat intelligence platforms, malware analysis or sandboxing tools, network detection tools, and cloud security across Azure, AWS, or GCP is nice to have

• Full-time contractor arrangement
• Remote work from Pakistan
• Shift allowances for evenings, nights, weekends, and public holidays
• Modern SOC stack and tooling
• Agentic SOC platform enabling AI-assisted triage and investigations
• Clear career progression into L3, Threat Hunting, Detection Engineering, or Incident Response
• Structured onboarding and continuous learning support
• Investigation-led culture focused on quality over ticket volume