We are looking for an experienced SOC Security Engineer – Tier 2 to support our MSSP operations and provide advanced security monitoring and incident response services to multiple enterprise customers. The role focuses on advanced security investigations, incident handling, threat hunting, detection engineering, and SIEM optimization across diverse enterprise environments. The engineer will also support Tier 1 analysts and contribute to improving SOC capabilities and service quality.

Key Responsibilities
Perform advanced investigation and analysis of security incidents escalated by Tier 1 analysts.
Analyze and correlate security events across SIEM, EDR/XDR, NDR, IDS/IPS, firewalls, and other security platforms.
Investigate complex threats, including ransomware, malware, account compromise, privilege escalation, lateral movement, persistence, and data exfiltration.
Determine attack vectors, scope, impact, affected systems, and potential business risks.
Lead incident response activities, including containment recommendations, eradication support, and recovery coordination.
Perform advanced log analysis, timeline reconstruction, and evidence collection.
Conduct proactive threat hunting using SIEM queries, endpoint telemetry, threat intelligence, and MITRE ATT&CK.
Develop, implement, test, and optimize SIEM detection rules, correlation use cases, and alerting mechanisms.
Identify detection gaps, reduce false positives, and improve detection coverage.
Analyze and operationalize threat intelligence, IOCs, and attacker TTPs.
Support vulnerability and exposure investigations when relevant to active threats.
Provide technical guidance, mentoring, and investigation support to Tier 1 analysts.
Prepare detailed incident reports and recommendations for customers and internal stakeholders.
Support MSSP service delivery, customer-specific SLAs, escalation procedures, and operational improvements.

Required Technical Skills
Strong knowledge of SOC operations, incident response, threat analysis, and advanced investigation methodologies.
Hands-on experience with SIEM platforms such as Splunk, Elastic Security.
Advanced knowledge of SIEM query languages such as KQL, SPL, or Lucene.
Strong understanding of Windows, Linux, Active Directory, authentication mechanisms, and enterprise infrastructure.
Advanced knowledge of network protocols, traffic analysis, firewalls, K8s, VPNs, DNS, proxies, and network security.
Practical experience with EDR/XDR, NDR, IDS/IPS, and endpoint investigation.
Knowledge of malware behavior, persistence techniques, privilege escalation, lateral movement, and common attack frameworks.
Experience developing and tuning detection rules using Sigma and MITRE ATT&CK.
Familiarity with threat hunting, threat intelligence, and incident investigation tools.
Scripting skills in Python or PowerShell are preferred.
Knowledge of cloud security monitoring and Microsoft 365 environments is an advantage.

Qualifications and Experience
Bachelor's degree in IT, Computer Science, Cybersecurity, or equivalent practical experience.
3 years of experience in SOC operations, incident response, threat hunting, or security engineering.
Proven hands-on experience investigating and handling complex security incidents.
Practical experience with SIEM deployment, query development, detection tuning, and log analysis.
Experience in MSSP or multi-customer enterprise SOC environments is highly preferred.

Professional Competencies
Strong analytical, investigative, and problem-solving skills.
Ability to independently investigate complex security incidents.
Strong technical documentation and communication skills.
Ability to work under pressure and prioritize incidents based on business impact.
Leadership, teamwork, mentoring, and knowledge-sharing capabilities.
Customer-oriented mindset, accountability, and confidentiality.
Ability to support shift-based SOC operations when required.

Key Performance Indicators (KPIs)
Quality and accuracy of advanced incident investigations.
Mean Time to Investigate (MTTI) and Mean Time to Respond (MTTR).
Effectiveness of incident containment and escalation.
Detection rule quality and false-positive reduction.
Threat hunting effectiveness and identification of previously undetected threats.
Compliance with customer SLAs and incident response procedures.
Quality of technical reports and customer recommendations.
Tier 1 mentoring and contribution to SOC process improvement.