SOC Analyst
Lexmark is now a proud part of Xerox, bringing together two trusted names and decades of expertise into a bold and shared vision.
When you join us, you step into a technology ecosystem where your ideas, skills, and ambition can shape what comes next. Whether you’re just starting out or leading at the highest levels, this is a place to grow, stretch, and make real impact—across industries, countries, and careers.
From engineering and product to digital services and customer experience, you’ll help connect data, devices, and people in smarter, faster ways. This is meaningful, connected work—on a global stage, with the backing of a company built for the future, and a robust benefits package designed to support your growth, well-being, and life beyond work.
We are seeking a Security Operations Center (SOC) Analyst, Level 2 to serve as a key line of defense in protecting Xerox information systems. You will triage and investigate security alerts, correlate evidence across multiple telemetry sources, and drive timely resolution or escalation. This role leverages AI-assisted detection and investigation capabilities to accelerate analysis while maintaining strict independent validation against authoritative telemetry and established runbooks.
Purpose
Ensure the security and integrity of organizational information systems by proactively monitoring, detecting, and investigating security threats. By maintaining a vigilant and responsive security posture, the SOC Analyst helps protect sensitive data, supports business continuity, and improves detection and response outcomes. The analyst uses AI-assisted capabilities to accelerate triage and investigations, while independently validating model outputs against authoritative telemetry and established procedures.
Scope
As an L2 SOC Analyst you will primarily focus on deeper analysis of security alerts and incidents that require cross-source correlation, hypothesis-driven investigation, and risk-based decisioning (e.g., monitor vs contain). You will execute response actions that are pre-approved in playbooks, verify outcomes, and escalate exceptions (critical assets, high business impact, ambiguous root cause, or destructive/high-blast-radius actions) to senior SOC/Incident Response resources. You will produce investigation artifacts (timeline, evidence, and queries used) suitable for peer review and audit and contribute to continuous improvement through structured feedback to detection engineering.
Influence
As a member of Xerox Cyber Security (XCS), the SOC Analyst actively influences the security culture through operational rigor, clear documentation, and disciplined escalation. You will share investigation insights to improve detections, reduce recurring false positives, and strengthen the organization’s overall security posture. You will also participate in security awareness and end-user engagement activities as needed to reinforce secure behaviors and reporting practices.
Key Responsibilities
Incident Monitoring, Investigation, and Response
Monitor and triage security alerts and events using security tools and technologies (e.g., SIEM, EDR/XDR, IAM/IdP telemetry, email security, cloud audit logs).
Investigate medium-to-complex alerts to determine scope, impact, and likely root cause; build defensible incident narratives grounded in evidence.
Perform cross-source correlation and create timelines across endpoint, identity, network, and cloud/SaaS telemetry to validate detections and identify related activity.
Use hypothesis-driven investigation techniques: generate competing hypotheses, design targeted tests, and update conclusions as evidence changes.
Make risk-based decisions aligned to runbooks (e.g., contain vs monitor); document rationale, confidence level, and next steps.
AI-Assisted Investigation and Verification
Leverage AI-assisted investigation capabilities (e.g., summarization, enrichment, clustering, prioritization) to accelerate triage while never accepting model outputs at face value; independently validate AI conclusions against authoritative telemetry before acting.
Translate 'why flagged' signals into evidence-based explanations suitable for peer review; identify and document inconsistencies, hallucinations, or missing context in AI outputs.
Execute response actions that are pre-approved in playbooks (e.g., account containment requests, IOC blocking per procedure); verify outcomes and document success/failure states.
Escalate cases with complete context (timeline, evidence, scope/impact, actions taken, recommended next steps) when severity, ambiguity, or business impact warrants senior involvement.
Documentation, Communication, and Automation Safety
Document investigations in the case management system, including queries used, evidence excerpts, timeline, decisions, actions taken, residual risk, and handoff notes.
Provide structured feedback to detection engineering/ML stakeholders (TP/FP label and rationale, telemetry gaps, tuning recommendations) to improve alert fidelity.
Maintain up-to-date knowledge of cybersecurity threats, attacker techniques, and detection best practices.
Basic Qualifications
Bachelor's degree in computer science, Information Technology, or a related field (or equivalent practical experience).
2+ years of experience in a Security Operations Center, security monitoring, or incident triage/investigation role (Level 2 or equivalent).
Applied proficiency and experience investigating alerts using SIEM queries/pivots and one or more of the following: EDR/XDR, IAM/IdP telemetry, cloud audit logs, email security, network telemetry.
Strong analytical and problem-solving skills; ability to conduct hypothesis-driven investigations and produce defensible conclusions.
Strong written and verbal communication skills; ability to collaborate effectively across teams and produce case notes suitable for peer review and audit.
Ability to work in a fast-paced environment and manage multiple concurrent investigations, including clean handoffs across shifts.
Working knowledge of AI-assisted security operations concepts and limitations (e.g., false positives, bias, hallucinations) with a bias toward validation and evidence.
Discipline in sensitive data handling and data minimization when using AI tools (use approved platforms; redact/exclude unnecessary sensitive details).
Preferred Qualifications
Certifications such as CompTIA Security+, CEH, GIAC (e.g., GCIH/GCIA/GMON), or similar.
Experience with MITRE ATT&CK mapping and using it to structure investigations and communicate findings.
Experience investigating cloud environments (AWS, Azure) and interpreting cloud/SaaS audit telemetry.
Experience with scripting or query languages (e.g., Python, PowerShell, SQL) for basic enrichment, log parsing, and analysis.
Experience executing SOAR playbooks with appropriate human-in-the-loop approvals and validation/rollback awareness.
Experience contributing to detection improvements (writing/adjusting SIEM queries, proposing tuning changes, documenting repeatable triage logic).
Experience using LLM/AI copilots for investigation acceleration with strict validation and data-handling practices.