Openings - Title: SOC Engineer :: Location: Austin or San Antonio, TX (Onsite – Need local).

Role: SOC Engineer

Location: Austin or San Antonio, TX (Onsite – Need local)

Duration: 12+ months (Contract)

Position Description:

L2 SOC Engineer serves as the escalation point for L1 analysts, performing in-depth investigation and validation of security alerts, executing response actions within defined authority, and escalating confirmed incidents to Incident Response or L3. The role blends analytical investigation with engineering tasks such as tuning detections and improving alert fidelity.

Key Responsibilities

• Investigate and validate escalations from L1 analysts; determine true positive vs. false positive with documented analysis.
• Perform deep-dive analysis using SIEM, EDR, NDR, email security, and threat intelligence platforms.
• Execute approved containment actions (host isolation, account disablement, IOC blocking) per client runbooks.
• Escalate confirmed or high-severity incidents to Incident Response / L3 with complete investigation notes and evidence.
• Tune detection rules and correlation logic to reduce false positives; submit detection improvement requests to L3/engineering.
• Maintain and update investigation playbooks, SOPs, and knowledge base articles.
• Perform threat hunting tasks based on threat intelligence advisories and hypotheses provided by L3/threat intel.

Required Qualifications

• 2–4 years of SOC or security monitoring experience, including at least 1 year at L1 or equivalent.
• Hands-on experience with at least one enterprise SIEM (Exabeam, Splunk, Sentinel, QRadar) and one EDR platform.
• Solid understanding of TCP/IP, DNS, HTTP/S, email protocols, Windows/Active Directory, and Linux fundamentals.
• Working knowledge of MITRE ATT&CK, common malware behaviors, and phishing/BEC investigation techniques.
• Ability to write clear, structured investigation notes and client-facing alert summaries.
• Willingness to work in 24x7 rotational shifts, including nights, weekends, and holidays.

Preferred Qualifications

• Certifications: Security+, CySA+, GCIA, GSEC, BTL1/BTL2, vendor certifications (Splunk Core, Exabeam, CrowdStrike).
• Basic scripting (Python, PowerShell, KQL/SPL query development).
• Exposure to cloud security monitoring (AWS CloudTrail, Azure AD/Entra logs, O365/Google Workspace).