SOC Analyst Level 2

About the role

SecurityHQ is hiring a SOC Analyst Level 2 for its 24/7 Security Operations Centre in Dubai. You will investigate and respond to complex security incidents across a diverse customer environment, working with Level 1 analysts, incident responders and security engineers. The role suits an experienced SOC professional who enjoys solving complex security problems, mentoring juniors and improving detection capabilities in a fast-paced MSSP setting.

The schedule is rotating shifts (7 AM to 3 PM, 3 PM to 11 PM, 11 PM to 7 AM), including weekends and holidays, with two days off per week. You will be based onsite in Dubai and assigned to one of three customer locations within about 20 km of the office.

Key responsibilities

• Investigate incidents escalated from Level 1 analysts and analyse events across SIEM, EDR, network, endpoint and cloud technologies
• Identify attack vectors, root causes and scope of incidents, and lead containment, mitigation and remediation with internal and customer teams
• Investigate malware, phishing, suspicious activity and advanced threat campaigns
• Develop detection rules, use cases, SOC playbooks and monitoring capabilities, and take part in threat hunting
• Mentor Level 1 analysts and produce incident reports, root cause analyses and customer communications
• Support compliance, audit and post-incident reviews, and help administer and optimise SIEM and EDR platforms

Required profile

• Experience in a SOC, MSSP or cybersecurity operations environment
• Strong incident investigation and response experience
• Understanding of MITRE ATT&CK and Cyber Kill Chain
• Knowledge of malware, phishing, lateral movement and privilege escalation
• Networking concepts, protocols and traffic analysis
• Ability to make sound decisions under pressure and work in a global team
• Certifications such as GCIH, GCIA, CEH, SC-200 or SIEM-specific ones are beneficial

Required skills

• SIEM tools: Microsoft Sentinel, QRadar, Splunk or similar
• Cloud security monitoring in Azure, AWS or GCP is advantageous
• Advanced log analysis and event correlation