The SOC Tier 2 Analyst serves as the primary escalation point for the Tier 1 SOC team, responsible for advanced threat detection, investigation, and incident response coordination. This role acts as a technical lead, ensuring that security incidents are properly triaged, investigated, and remediated while continuously improving security operations processes.
The SOC Tier 2 Analyst plays a critical role in cybersecurity defense, supporting real-time monitoring, forensic analysis, and threat hunting. They will assist incident responders across all lifecycle phases, from detection to post-incident reviews, and contribute to SOC process optimizations.
Roles & Responsibilities:
-
Act as the primary escalation point for SOC Tier 1 analysts, providing technical expertise and guidance in incident handling.
-
Perform deep-dive analysis of security events, leveraging SIEM, EDR, IDS/IPS, and other security tools.
-
Identify common attack techniques (MITRE ATT&CK framework) and investigate anomalies to detect advanced persistent threats (APTs).
-
Assist in security incident response, leading containment, eradication, and recovery efforts.
-
Conduct artifact analysis to determine the root cause and scope of security incidents.
-
Collaborate with Threat Intelligence and Threat Hunting teams to improve detection rules and incident response playbooks.
-
Develop and refine SOC standard operating procedures (SOPs) to enhance security event triage and response.
-
Work with engineering teams to fine-tune security controls and improve overall SOC efficiency.
-
Mentor and train Tier 1 analysts to improve SOC maturity and ensure effective knowledge transfer.
-
Support security audits, compliance initiatives, and reporting efforts as required.
Basic Qualifications and Experience:
Functional Skills:
Must-Have Skills:
-
Strong understanding of SOC operations, including event triage, escalation, and investigation.
-
Experience analyzing cybersecurity threats and understanding attacker TTPs (Tactics, Techniques, and Procedures).
-
Proficiency in security tools such as SIEM (Splunk, QRadar, Sentinel), EDR (CrowdStrike, Defender ATP), IDS/IPS, and firewall logs.
-
Experience in incident response across all phases (detection, containment, eradication, recovery).
-
Knowledge of Windows and Linux security, including log analysis, PowerShell, and Bash scripting.
Good-to-Have Skills:
-
Experience in 24/7 SOC operations and shift leadership.
-
Knowledge of forensic tools (Volatility, Autopsy, FTK) and malware analysis techniques.
-
Understanding of cloud security monitoring (AWS, Azure, GCP).
-
Familiarity with MITRE ATT&CK, NIST Cybersecurity Framework, and CIS controls.
-
Threat hunting experience to proactively detect unknown threats.
Professional Certifications:
Soft Skills:
-
Strong communication and collaboration skills, particularly when working with global teams.
-
Ability to manage and prioritize tasks effectively in a high-pressure environment.
-
Critical thinking and problem-solving abilities, especially in incident response situations.
-
A commitment to continuous learning and knowledge sharing.