Level 2 SOC Analyst
Description
This is an excellent opportunity to start with an Organisation Of Choice on a great contract start!!!
About the role
We are seeking a Level 2 SOC Analyst with strong investigation and incident response skills. This role suits someone who can take ownership of escalated security alerts, establish what happened and coordinate an effective response.
You will investigate threats across endpoint, identity, email, network and cloud environments, working with security engineers and IT teams to contain incidents and strengthen detection capabilities.
Key responsibilities
Investigate escalated alerts, distinguish malicious activity from false positives and assess incident severity.
Lead assigned investigations into phishing, malware, compromised accounts, suspicious access and other security incidents.
Analyse SIEM events, endpoint telemetry, authentication logs and network activity to establish incident scope and timelines.
Coordinate containment, eradication and recovery actions with the relevant teams.
Document findings, preserve relevant evidence and provide clear incident updates.
Conduct threat hunting and identify activity associated with persistence, lateral movement and data exfiltration.
Improve detection rules, response playbooks and investigation procedures.
Support Level 1 analysts through technical guidance and constructive feedback.
What you will bring
Practical experience in a SOC or incident response role, including handling Level 2 escalations.
Strong investigative judgement and the ability to follow an incident through to resolution.
Hands-on experience with SIEM and EDR platforms, such as Microsoft Sentinel, Splunk, Microsoft Defender or CrowdStrike.
Understanding of Windows environments, Active Directory, Microsoft Entra ID, networking and common attacker techniques.
Experience investigating identity, endpoint and email security incidents.
Ability to write effective investigation queries; familiarity with KQL or SPL is advantageous.
Clear written and verbal communication, including the ability to explain technical findings to non-technical stakeholders.
Desirable experience
Security investigations across Microsoft 365, Azure or AWS.
Digital forensics, malware triage or scripting with PowerShell or Python.
Applying MITRE ATT&CK to investigations and detection improvements.
Relevant security certifications or equivalent practical experience.
Apply
If you enjoy investigating threats, making sound response decisions and improving how a SOC operates, we would like to hear from you.
Apply with your CV and a brief outline of your SOC investigation and incident response experience.