Our client in IT/Tech sector is seeking a
seeking a SOC Analyst II to join the security operations team. This is a hands-on, second-line role at the center of the client's detection and response program.
Job Summary
The ideal candidate will spend each day investigating security alerts that have escalated beyond the initial triage layer, distinguishing genuine threats from false positives, and driving confirmed incidents through containment, remediation, and resolution. The ideal candidate will operate in a fast-paced, telemetry-rich environment spanning cloud and on-premises infrastructure, thousands of endpoints, and a modern security stack that includes SIEM, EDR, and email security platforms.
Beyond day-to-day monitoring, the ideal candidate will take ownership of improving the effectiveness of the security operations function. The ideal candidate will contribute to maturing detection content, reducing alert fatigue by tuning false positives, and enhancing incident response runbooks and playbooks to ensure consistent handling across shifts. Working closely with senior SOC analysts, threat hunters, and detection engineers, the ideal candidate will have the opportunity to strengthen technical expertise and progress toward a Tier 3 SOC Analyst or specialized Security Engineering career path. This is a fully remote opportunity available on either a full-time or contract basis.
Key Responsibilities
Monitor, triage, and investigate security alerts across SIEM, EDR, identity, and email security platforms
Own Tier 2 investigation, containment, eradication, and escalation of confirmed security incidents
Analyze logs, network traffic, endpoint telemetry, and user activity to identify indicators of compromise
Conduct root cause analysis and document incidents, findings, and response actions per established runbooks
Tune detection rules, suppress false positives, and recommend new detection logic in partnership with engineering
Participate in proactive threat hunting based on current threat intelligence and emerging tactics
Support and contribute to post-incident reviews, lessons learned, and continuous improvement of response playbooks
Maintain shift handoff notes and ensure continuity of monitoring across a 24/7 coverage model
Required Qualifications
2 to 4 years of hands-on SOC, incident response, or security analyst experience
Working knowledge of SIEM platforms such as Splunk, Microsoft Sentinel, or QRadar
Familiarity with EDR tooling including CrowdStrike, SentinelOne, or Microsoft Defender
Solid grounding in networking fundamentals, TCP/IP, DNS, and common attack techniques
Ability to interpret logs and telemetry to reconstruct an attack timeline
Strong written documentation and clear communication under time pressure
Preferred Qualifications
Security+, CySA+, GCIH, or equivalent certification
Experience with SOAR platforms and automation scripting in Python or PowerShell
Working familiarity with the MITRE ATT&CK framework and threat-informed defense
Exposure to cloud security monitoring in AWS or Azure
