Security Analyst (Tier 2 SOC)

Security Analyst (Tier 2 SOC)

Security Analyst (Tier 2 SOC)

Department: Technical Operations / SOC

Reports to: Director of Technical Operations

Position Summary:

The Tier 2 SOC Analyst plays a critical role in defending clients from cyber threats through proactive monitoring, incident response, threat analysis, and effective management of client security services. This position is responsible for investigating escalated alerts, mentoring Tier 1 analysts, tuning and maintaining security platforms, supporting the onboarding and offboarding of clients across SOC applications and solutions, and enhancing the overall security posture of client environments.

Roles and Responsibilities:

Incident Response & Threat Analysis

Investigate security incidents escalated from Tier 1 SOC Analysts.
Conduct root cause analysis on recurring or advanced threats.
Identify and respond to phishing, malware, unauthorized access, insider threats, and other security events.
Assist with incident containment, remediation, documentation, and reporting.
Escalate significant incidents in accordance with established incident response procedures.

Security Platform Optimization

Tune SIEM, XDR, endpoint security, and other SOC platforms to improve detection accuracy and reduce false positives.
Recommend and implement enhancements to detection rules, alerting, and response playbooks.
Review security platform health, integrations, and data ingestion to identify configuration or coverage gaps.
Work closely with engineering and NOC to ensure security alerts are actionable and prioritized.

Client Security Onboarding & Offboarding

Perform technical onboarding of new clients into SOC-managed security applications, platforms, and solutions.Configure client environments, integrations, policies, alerting, monitoring, and required access according to established SOC standards and service requirements.Validate that required security tools, agents, integrations, log sources, and monitoring services are properly deployed and reporting as expected.
Coordinate with internal teams to ensure onboarding requirements and dependencies are completed accurately and on schedule.
Document client-specific configurations, integrations, contacts, escalation requirements, and operational procedures.
Perform technical offboarding of clients from SOC applications and solutions, including removal of integrations, agents, access, monitoring, and client-specific configurations as appropriate.
Validate completion of onboarding and offboarding activities using established checklists and quality-control procedures.
Identify gaps, inconsistencies, or opportunities to improve SOC onboarding and offboarding standards, documentation, and automation.

Threat Hunting & Research

Perform proactive threat hunting across client environments.
Analyze logs, endpoint telemetry, and network activity for indicators of compromise (IOCs).
Maintain awareness of emerging threats, vulnerabilities, attack techniques, and threat actor activity.
Recommend appropriate mitigations and detection improvements based on identified threats.

Mentorship & Collaboration

Guide and mentor Tier 1 SOC Analysts on investigation techniques, tools, documentation, and escalation procedures.
Assist Tier 1 analysts with complex or ambiguous security events.
Participate in internal tabletop exercises, training sessions, and knowledge-sharing activities.
Contribute to the deve