Role Summary
The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity.
Key Responsibilities
- Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning
- Lead incident response: containment, eradication, recovery and root cause analysis
- Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats
- Tune SIEM correlation rules and use cases to reduce false positives
- Run threat hunting based on threat intelligence and MITRE ATT&CK
- Create and maintain incident response playbooks and SOAR workflows
- Supervise and mentor L1 analysts, review their work, and manage shift handovers
- Write incident reports and present findings to technical and management stakeholders
- Report incidents in line with NCA requirements and SMC's escalation matrix
- Track SOC KPIs such as MTTD, MTTR and SLA compliance.
Requirements
- Bachelor's degree in Cybersecurity, Computer Science, IT or related field
- 4–6 years in a SOC, with at least 2 years at L2 level
- Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar)
- Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms
- Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols
- Experience in an enterprise or managed SOC (MSSP) environment
- Saudi national, fluent in Arabic and English
- Willing to support on-call or shift rotation if required
Preferred Certifications
GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification