Role Summary
You serve as the escalation point for Level 1 analysts in the Security Operations Center, performing in-depth investigations into escalated alerts and confirmed security incidents. You determine root cause, scope, and impact, lead containment and remediation for medium- and high-severity incidents within your authority, and coordinate with IT and business teams to restore normal operations. You develop and tune detections, contribute to response automation and playbooks, and mentor Level 1 analysts. You escalate critical or highly complex incidents to Level 3 analysts, the SOC Manager, and incident response leadership.
Key Responsibilities
Investigate escalated alerts and incidents
• Serve as the primary escalation point for Level 1 analysts, validating triage decisions and taking ownership of escalated alerts
• Perform in-depth investigations across endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact
• Build incident timelines by correlating data across Splunk ES, Palo Alto Cortex, and supporting log sources
• Assess incident severity and business impact, and escalate to Level 3 analysts or incident response leadership when defined thresholds are met
Lead containment and response
• Lead containment, eradication, and recovery for medium- and high-severity incidents within defined authority, including host isolation, account disablement, and IOC blocking
• Coordinate with IT infrastructure, identity, and application teams to execute and verify remediation actions
• Collect and preserve forensic evidence such as logs, endpoint artifacts, and memory captures, and maintain chain-of-custody documentation
• Write incident reports summarizing root cause, actions taken, and recommendations, and contribute findings to post-incident reviews
Improve detection and automation
• Develop new detection rules and correlation searches in Splunk ES mapped to MITRE ATT&CK techniques
• Tune detections based on false-positive trends and alert metrics, validating changes against historical data before deployment
• Identify repetitive analyst tasks and help build or enhance Cortex XSOAR playbooks for enrichment and response automation
• Operationalize threat intelligence by converting IOCs and TTPs into searches, watchlists, and detections
• Conduct hypothesis-driven threat hunts on emerging threats with guidance from Level 3 analysts
Mentor analysts and strengthen SOC operations
• Mentor and coach Level 1 analysts, reviewing ticket quality and providing feedback on investigation and documentation practices
• Create and update SOPs, playbooks, and runbooks based on investigation findings and lessons learned
• Track and report SOC metrics such as mean time to detect (MTTD), mean time to respond (MTTR), escalation accuracy, and false-positive rates
• Participate in the on-call rotation as an escalation resource and contribute to tabletop exercises and drills
Tools and Technologies You Might Use
• SIEM: Splunk ES, including SPL searches, correlation searches, and dashboards
• EDR: Palo Alto Cortex, including live response and host isolation
• SOAR and ticketing: Palo Alto Cortex XSOAR, ServiceNow, Jira
• Network security: firewalls, IDS/IPS, proxy and DNS logs, packet capture analysis (e.g., Wireshark)
• Identity and email: Active Directory / Entra ID authentication logs, email security gateway logs
• Threat intelligence and analysis: VirusTotal/Google Threat Intelligence, Recorded Future, malware analysis sandboxes
• Frameworks: MITRE ATT&CK, NIST incident response lifecycle, Cyber Kill Chain
Examples of Work and Technical Scope
• Investigate an escalated phishing campaign affecting multiple users, identify all recipients and clicks, and coordinate mailbox purges and credential resets
• Analyze a suspicious PowerShell or living-off-the-land execution chain to determine initial access, persistence, and any lateral movement
• Build a Splunk correlation search to detect impossible-travel or anomalous MFA activity and validate it against historical data
• Lead containment of a malware infection across several endpoints, including isolation, IOC sweeps, and verification of eradication
• Develop a Cortex XSOAR playbook that automates IOC enrichment for phishing alerts to reduce Level 1 handling time
• Review a week of Level 1 tickets and deliver coaching feedback on triage accuracy and documentation quality
Required Qualifications
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience
• 3-5 years of experience in security operations, incident response, or a related cybersecurity role, including at least 2 years as a SOC analyst
• Hands-on experience investigating incidents using SIEM and EDR platforms, including writing search queries (e.g., Splunk SPL)
• Solid understanding of Windows and Linux operating systems, Active Directory, and common log sources such as Windows Event Logs, Sysmon, firewall, and proxy logs
• Working knowledge of networking and protocols, including TCP/IP, DNS, HTTP/S, and SMTP, with the ability to analyze network traffic
• Practical experience applying MITRE ATT&CK to investigations and detection development
• Ability to lead response for medium- and high-severity incidents and communicate clearly with technical and non-technical stakeholders
• Strong written communication skills for incident reports, playbooks, and procedures
• Willingness to work shift-based coverage and participate in on-call rotation as an escalation resource
• Experience with scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense Operation and Investigation
• Ability to develop, execute queries (e.g., SPL, XQL) and scripts (Python, PowerShell) using VS Code for log analysis, and automated simulation of security scenarios to validate detection rules
• Experience monitoring deployed detections for failures, query errors, and logic gaps; investigate detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.
Preferred Qualifications
• Industry certifications such as CompTIA CySA+, GIAC GCIH, GIAC GCIA, or Splunk Certified Cybersecurity Defense Analyst
• Scripting experience in Python or PowerShell to automate enrichment, log parsing, or response tasks
• Experience building or maintaining SOAR playbooks, preferably in Cortex XSOAR
• Experience monitoring cloud and SaaS environments (e.g., AWS, Azure, Google Cloud, Microsoft 365)
• Experience working in retail, payments, or PCI DSS-regulated environments
