SOC Analyst II (Only W2)

Role Summary

You serve as the escalation point for Level 1 analysts in the Security Operations Center, performing in-depth investigations into escalated alerts and confirmed security incidents. You determine root cause, scope, and impact, lead containment and remediation for medium- and high-severity incidents within your authority, and coordinate with IT and business teams to restore normal operations. You develop and tune detections, contribute to response automation and playbooks, and mentor Level 1 analysts. You escalate critical or highly complex incidents to Level 3 analysts, the SOC Manager, and incident response leadership.

Key Responsibilities

Investigate escalated alerts and incidents

• Serve as the primary escalation point for Level 1 analysts, validating triage decisions and taking ownership of escalated alerts

• Perform in-depth investigations across endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact

• Build incident timelines by correlating data across Splunk ES, Palo Alto Cortex, and supporting log sources

• Assess incident severity and business impact, and escalate to Level 3 analysts or incident response leadership when defined thresholds are met

Lead containment and response

• Lead containment, eradication, and recovery for medium- and high-severity incidents within defined authority, including host isolation, account disablement, and IOC blocking

• Coordinate with IT infrastructure, identity, and application teams to execute and verify remediation actions

• Collect and preserve forensic evidence such as logs, endpoint artifacts, and memory captures, and maintain chain-of-custody documentation

• Write incident reports summarizing root cause, actions taken, and recommendations, and contribute findings to post-incident reviews

Improve detection and automation

• Develop new detection rules and correlation searches in Splunk ES mapped to MITRE ATT&CK techniques

• Tune detections based on false-positive trends and alert metrics, validating changes against historical data before deployment

• Identify repetitive analyst tasks and help build or enhance Cortex XSOAR playbooks for enrichment and response automation

• Operationalize threat intelligence by converting IOCs and TTPs into searches, watchlists, and detections

• Conduct hypothesis-driven threat hunts on emerging threats with guidance from Level 3 analysts

Mentor analysts and strengthen SOC operations

• Mentor and coach Level 1 analysts, reviewing ticket quality and providing feedback on investigation and documentation practices

• Create and update SOPs, playbooks, and runbooks based on investigation findings and lessons learned

• Track and report SOC metrics such as mean time to detect (MTTD), mean time to respond (MTTR), escalation accuracy, and false-positive rates

• Participate in the on-call rotation as an escalation resource and contribute to tabletop exercises and drills

Tools and Technologies You Might Use

• SIEM: Splunk ES, including SPL searches, correlation searches, and dashboards

• EDR: Palo Alto Cortex, including live response and host isolation

• SOAR and ticketing: Palo Alto Cortex XSOAR, ServiceNow, Jira

• Network security: firewalls, IDS/IPS, proxy and DNS logs, packet capture analysis (e.g., Wireshark)

• Identity and email: Active Directory / Entra ID authentication logs, email security gateway logs

• Threat intelligence and analysis: VirusTotal/Google Threat Intelligence, Recorded Future, malware analysis sandboxes

• Frameworks: MITRE ATT&CK, NIST incident response lifecycle, Cyber Kill Chain

Examples of Work and Technical Scope

• Investigate an escalated phishing campaign affecting multiple users, identify all recipients and clicks, and coordinate mailbox purges and credential resets

• Analyze a suspicious PowerShell or living-off-the-land execution chain to determine initial access, persistence, and any lateral movement

• Build a Splunk correlation search to detect impossible-travel or anomalous MFA activity and validate it against historical data

• Lead containment of a malware infection across several endpoints, including isolation, IOC sweeps, and verification of eradication

• Develop a Cortex XSOAR playbook that automates IOC enrichment for phishing alerts to reduce Level 1 handling time

• Review a week of Level 1 tickets and deliver coaching feedback on triage accuracy and documentation quality

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience

• 3-5 years of experience in security operations, incident response, or a related cybersecurity role, including at least 2 years as a SOC analyst

• Hands-on experience investigating incidents using SIEM and EDR platforms, including writing search queries (e.g., Splunk SPL)

• Solid understanding of Windows and Linux operating systems, Active Directory, and common log sources such as Windows Event Logs, Sysmon, firewall, and proxy logs

• Working knowledge of networking and protocols, including TCP/IP, DNS, HTTP/S, and SMTP, with the ability to analyze network traffic

• Practical experience applying MITRE ATT&CK to investigations and detection development

• Ability to lead response for medium- and high-severity incidents and communicate clearly with technical and non-technical stakeholders

• Strong written communication skills for incident reports, playbooks, and procedures

• Willingness to work shift-based coverage and participate in on-call rotation as an escalation resource

• Experience with scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense Operation and Investigation

• Ability to develop, execute queries (e.g., SPL, XQL) and scripts (Python, PowerShell) using VS Code for log analysis, and automated simulation of security scenarios to validate detection rules

• Experience monitoring deployed detections for failures, query errors, and logic gaps; investigate detections that stop triggering.

• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.

Preferred Qualifications

• Industry certifications such as CompTIA CySA+, GIAC GCIH, GIAC GCIA, or Splunk Certified Cybersecurity Defense Analyst

• Scripting experience in Python or PowerShell to automate enrichment, log parsing, or response tasks

• Experience building or maintaining SOAR playbooks, preferably in Cortex XSOAR

• Experience monitoring cloud and SaaS environments (e.g., AWS, Azure, Google Cloud, Microsoft 365)

• Experience working in retail, payments, or PCI DSS-regulated environments