SOC Analyst- Tier 2 Investigation

Madre Integrated Engineering Full time

• Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
  
• Perform detailed analysis of security events, logs, network traffic, and endpoint activities to identify malicious behavior.
  
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
  
• Analyze Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) to determine the scope and impact of security incidents.
  
• Perform proactive threat hunting exercises using SIEM, EDR, and threat intelligence platforms.
  
• Investigate advanced threats, malware infections, phishing attacks, insider threats, and anomalous activities.
  
• Correlate events from multiple security tools to identify attack patterns and potential breaches.
  
• Develop and enhance use cases, detection rules, correlation logic, and SOC playbooks.
  
• Document investigation findings, root cause analysis, and incident reports.
  
• Collaborate with IT, infrastructure, network, and application teams during incident response activities.
  
• Support digital forensics activities and evidence collection when required.
  
• Participate in security incident response drills and continuous improvement initiatives.
  
• Mentor junior SOC analysts and provide technical guidance on complex investigations.
  

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
  
• 5-8 years of experience in Cyber Security Operations Center (SOC) environments.
  
• Minimum 3+ years of experience performing Tier 2 or advanced security investigations.
  
• Professional certification:
  • CompTIA CySA+ (Cybersecurity Analyst), or
    
  • GIAC Certified Intrusion Analyst (GCIA)
    
• Strong understanding of:
  • Security Incident Response
    
  • Threat Detection and Analysis
    
  • Network Security
    
  • Endpoint Security
    
  • Security Monitoring
    
  • Threat Intelligence
    
• Experience with enterprise SIEM platforms such as:
  • Microsoft Sentinel
    
  • Splunk
    
  • IBM QRadar
    
  • ArcSight
    
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, Carbon Black, or SentinelOne.