SOC Analyst – L2

Role Overview

As an L2 SOC Analyst, you will take ownership of security alerts that need deeper investigation, using evidence from endpoints, networks, and security platforms to determine what happened and how serious it is. Your findings will help the security and IT teams contain threats, improve detection, and strengthen the organisation’s response to attacks.

Key Responsibilities

• Investigate escalated alerts and incidents, distinguishing genuine threats from benign activity and assessing potential business impact.
• Review and correlate events in SIEM, EDR/XDR, IDS/IPS, and other monitoring tools to trace activity across systems and endpoints.
• Analyse security logs and identify indicators of compromise, attack techniques, and affected assets.
• Carry out proactive threat hunting and support containment, remediation, and root-cause investigations.
• Maintain and refine detection rules, alert settings, and SOC procedures based on investigation outcomes.
• Document evidence, analysis, impact, and recommended actions in clear incident reports.
• Coordinate with cybersecurity and IT colleagues to improve monitoring and incident-response practices.

Requirements & Qualifications

• At least three years of hands-on experience in a SOC or cybersecurity operations role, including Level 2 investigations.
• Practical experience with a SIEM platform such as Microsoft Sentinel, Splunk, IBM QRadar, or an equivalent solution.
• Working knowledge of EDR/XDR tools, network security monitoring, and security log analysis.
• Understanding of incident response, threat detection, common attack methods, and the MITRE ATT&CK framework.
• Strong analytical and troubleshooting ability, with care in handling evidence and documenting findings.
• Relevant cybersecurity certifications are an advantage.

What We Offer / Why Join

This full-time role is based in Abu Dhabi, United Arab Emirates.