About the role
Role Summary
The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity.
Key Responsibilities
- Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning - Lead incident response: containment, eradication, recovery and root cause analysis - Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats - Tune SIEM correlation rules and use cases to reduce false positives - Run threat hunting based on threat intelligence and MITRE ATT&CK - Create and maintain incident response playbooks and SOAR workflows - Supervise and mentor L1 analysts, review their work, and manage shift handovers - Write incident reports and present findings to technical and management stakeholders - Report incidents in line with NCA requirements and SMC's escalation matrix - Track SOC KPIs such as MTTD, MTTR and SLA compliance.
Requirements
- Bachelor's degree in Cybersecurity, Computer Science, IT or related field - 4–6 years in a SOC, with at least 2 years at L2 level - Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar) - Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms - Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols - Experience in an enterprise or managed SOC (MSSP) environment - Saudi national, fluent in Arabic and English - Willing to support on-call or shift rotation if required
Preferred Certifications
GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification
Text as published by Müller`s Solutions. We don't edit postings; apply and ask questions on the employer's site.