SOC Analyst II

About the role

The work covers the full life of an incident, from detection through containment and recovery, plus threat hunting and vulnerability management. There is room to move into team leadership as the role grows.

At a glance

What you will do

• Take ownership of high-severity alerts and incidents escalated from Tier I analysts
• Investigate endpoints, network traffic and logs to confirm incidents and find root causes
• Lead containment, eradication and recovery while following incident response plans
• Run threat hunts and manage vulnerability remediation with IT and engineering
• Write executive reports and mentor junior analysts

What they look for

• US citizenship and eligibility for a Secret clearance
• Two to five years in a security operations centre or similar cyber or IT administration work
• Skill with incident response, log correlation and host and network artefacts
• Intermediate to advanced knowledge of Windows internals

A typical week

• Investigating concurrent incidents across a multi-tenant client base
• Mapping attack chains with MITRE ATT&CK and the Cyber Kill Chain
• Writing playbooks and updating standard operating procedures
• Taking part in an on-call rotation outside business hours