The SOC L2 Specialist handles escalated security alerts, leads incident response activities, and supervises day-to-day operations within the Security Operations Center. Responsibilities include investigating threats, tuning SIEM rules, mentoring L1 analysts, and tracking performance KPIs. Candidates require four to six years of SOC experience, a relevant bachelor degree, and expertise in SIEM, EDR, and incident response.
Role Summary
The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity.
Key Responsibilities
- Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning
- Lead incident response: containment, eradication, recovery and root cause analysis
- Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats
- Tune SIEM correlation rules and use cases to reduce false positives
- Run threat hunting based on threat intelligence and MITRE ATT&CK
- Create and maintain incident response playbooks and SOAR workflows
- Supervise and mentor L1 analysts, review their work, and manage shift handovers
- Write incident reports and present findings to technical and management stakeholders
- Report incidents in line with NCA requirements and SMC's escalation matrix
- Track SOC KPIs such as MTTD, MTTR and SLA compliance.
Requirements
- Bachelor's degree in Cybersecurity, Computer Science, IT or related field
- 4–6 years in a SOC, with at least 2 years at L2 level
- Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar)
- Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms
- Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols
- Experience in an enterprise or managed SOC (MSSP) environment
- Saudi national, fluent in Arabic and English
- Willing to support on-call or shift rotation if required
Preferred Certifications
GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification
Unlock the full job description
Create a free account to read every duty and requirement, and to contact the employer directly.