Job Summary:
The SOC Analyst II will serve as the escalation point for Level 1 analysts in the Security Operations Center, performing in-depth investigations into escalated alerts and confirmed security incidents. The role involves determining root cause, scope, and impact, leading containment and remediation for medium- and high-severity incidents within defined authority, and coordinating with IT and business teams to restore normal operations. The analyst will develop and tune detections, contribute to response automation and playbooks, and mentor Level 1 analysts. Critical or highly complex incidents will be escalated to Level 3 analysts, the SOC Manager, and incident response leadership. This is an onsite position based in Irving, TX.
Key Responsibilities:
• Serve as the primary escalation point for Level 1 analysts, validating triage decisions and taking ownership of escalated alerts.
• Perform in-depth investigations across endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact.
• Build incident timelines by correlating data across Splunk ES, Palo Alto Cortex, and supporting log sources.
• Assess incident severity and business impact, escalating to Level 3 analysts or incident response leadership when defined thresholds are met.
• Lead containment, eradication, and recovery for medium- and high-severity incidents within defined authority, including host isolation, account disablement, and IOC blocking.
• Coordinate with IT infrastructure, identity, and application teams to execute and verify remediation actions.
• Collect and preserve forensic evidence, including logs, endpoint artifacts, and memory captures, while maintaining chain-of-custody documentation.
• Prepare incident reports summarizing root cause, actions taken, and recommendations, and contribute findings to post-incident reviews.
• Develop new detection rules and correlation searches in Splunk ES mapped to MITRE ATT&CK techniques.
• Tune detections based on false-positive trends and alert metrics, validating changes against historical data before deployment.
• Identify repetitive analyst tasks and help build or enhance Cortex XSOAR playbooks for enrichment and response automation.
• Convert threat intelligence indicators and TTPs into searches, watchlists, and detections.
• Conduct hypothesis-driven threat hunts for emerging threats with guidance from Level 3 analysts.
• Mentor and coach Level 1 analysts by reviewing ticket quality and providing feedback on investigation and documentation practices.
• Create and update SOPs, playbooks, and runbooks based on investigation findings and lessons learned.
• Track and report SOC metrics such as mean time to detect (MTTD), mean time to respond (MTTR), escalation accuracy, and false-positive rates.
• Participate in the on-call rotation as an escalation resource and contribute to tabletop exercises and drills.
• Develop and execute queries and scripts using tools such as SPL, XQL, Python, PowerShell, and VS Code for log analysis and automated security scenario simulations to validate detection rules.
• Monitor deployed detections for failures, query errors, and logic gaps, and investigate detections that stop triggering.
• Conduct attack simulations and evaluate detection coverage, alert accuracy, and effectiveness to drive continuous improvements.
Required Qualifications:
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent professional experience.
• 3-5 years of experience in security operations, incident response, or a related cybersecurity role, including at least 2 years as a SOC analyst.
• Hands-on experience investigating incidents using SIEM and EDR platforms, including writing search queries such as Splunk SPL.
• Solid understanding of Windows and Linux operating systems, Active Directory, and common log sources such as Windows Event Logs, Sysmon, firewall, and proxy logs.
• Working knowledge of networking and protocols, including TCP/IP, DNS, HTTP/S, and SMTP, with the ability to analyze network traffic.
• Practical experience applying MITRE ATT&CK to investigations and detection development.
• Ability to lead responses to medium- and high-severity incidents and communicate clearly with technical and non-technical stakeholders.
• Strong written communication skills for incident reports, playbooks, and procedures.
• Willingness to work shift-based coverage and participate in an on-call rotation as an escalation resource.
• Experience with scripting or automation tools such as PowerShell, Python, or XQL for cyber defense operations and investigations.
• Ability to develop and execute queries such as SPL and XQL, and scripts using Python or PowerShell for log analysis and automated security scenario simulations.
• Experience monitoring deployed detections for failures, query errors, and logic gaps, and investigating detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.
Preferred Qualifications:
• Industry certifications such as CompTIA CySA+, GIAC GCIH, GIAC GCIA, or Splunk Certified Cybersecurity Defense Analyst.
• Scripting experience in Python or PowerShell to automate enrichment, log parsing, or response tasks.
• Experience building or maintaining SOAR playbooks, preferably in Cortex XSOAR.
• Experience monitoring cloud and SaaS environments such as AWS, Azure, Google Cloud, and Microsoft 365.
• Experience working in retail, payments, or PCI DSS-regulated environments.
• Experience with SIEM platforms such as Splunk ES, including SPL searches, correlation searches, and dashboards.
• Experience with EDR platforms such as Palo Alto Cortex, including live response and host isolation.
• Experience with SOAR and ticketing platforms such as Palo Alto Cortex XSOAR, ServiceNow, and Jira.
• Knowledge of network security technologies, including firewalls, IDS/IPS, proxy and DNS logs, and packet capture analysis tools such as Wireshark.
• Experience analyzing identity and email security data, including Active Directory and Microsoft Entra ID authentication logs and email security gateway logs.
• Familiarity with threat intelligence and analysis tools such as VirusTotal, Google Threat Intelligence, Recorded Future, and malware analysis sandboxes.
• Knowledge of security frameworks such as MITRE ATT&CK, NIST Incident Response Lifecycle, and Cyber Kill Chain.
