Security Analyst - Tier 2
Core
Investigate escalated security alerts across endpoint, identity, cloud, email, and network layers to determine scope, impact, and root cause using EDR, SIEM, and supporting telemetry.
Role type
Senior Security Analyst (Tier 2)
Builds
SOC runbooks, triage guides, investigation procedures, and structured feedback on detection quality
Domain
Cybersecurity / Security Operations Center (SOC)
Required skills
EDR platforms, SIEM-based investigation, MITRE ATT&CK mapping, Windows/Linux internals, networking fundamentals (TCP/IP, DNS, HTTP/S), scripting (Python), SOAR platforms
Preferred skills
BTL2, OSDA, or CDSA certifications
Technologies
EDR, SIEM, SOAR, Python
Responsibilities
Investigate escalated security alerts; Determine scope, impact, and root cause using EDR, SIEM, and telemetry; Escalate suspected incidents to Incident Response and complex cases to Tier 3; Provide structured feedback on detection quality and false-positive patterns; Contribute to and refine SOC runbooks and triage guides; Review Tier 1 escalations and coach on handoff quality; Document investigations for handoff and lessons learned; Participate in on-call rotation as investigative point of contact
Seniority
Senior, hands-on IC