Security Operations Center Analyst L2

EVOCS Overview

EVOCS's journey began with a mission to empower businesses with advisory expertise, empowered with ideal technologies to provide them with comprehensive solutions to grow and prosper.

Founded by a team of passionate experts, EVOCS has grown into a trusted partner to a growing number of leaders across their respective industries. Our roots in employee-managed operations reflect our commitment to quality, consistency, and client success.

If you enjoy working in a hyper-fast-growing company, are eager to be part of an agile team, and want to be part of our success story, then let's talk!

🎯 Role Overview

As a SOC Analyst L2, you will own escalated incidents from investigation through containment across FortiSIEM, FortiSOAR and Microsoft Defender XDR.

You will be responsible for finding root cause, driving response, sharpening detections and automation, and raising the bar for the L1 analysts who escalate to you.

🧩 What You Will Do

In this role, you will:

Investigation & Hunting

• Investigate incidents escalated from L1: build the full timeline, determine scope and root cause, and confirm impact
• Correlate endpoint, identity, email and network telemetry across Defender for Endpoint, Defender for Identity, Defender for Office 365 and FortiGate / FortiSIEM logs
• Hunt proactively with Defender XDR advanced hunting (KQL) and FortiSIEM searches, mapped to MITRE ATT&CK

Incident Response

• Lead containment and eradication — device isolation, account disablement, indicator blocking, malicious email purge — coordinating with IT and network teams
• Write incident reports covering timeline, root cause, actions taken and recommendations; brief client stakeholders on high-severity events
• Support major incident response and escalate to L3, IR or threat intel when required

Detection Engineering & Automation

• Build, tune and retire FortiSIEM correlation rules, watchlists and reports to cut false positives and close detection gaps
• Design and maintain FortiSOAR playbooks for enrichment, triage and automated response
• Tune Defender policies, custom detections, suppression rules and alert thresholds

Mentorship & Continuous Improvement

• Act as escalation point and mentor for L1 — review case quality, coach on investigations and update runbooks
• Track SOC metrics (MTTD, MTTR, false-positive rate) and recommend process improvements

🧠 What You Will Bring

The top candidate will have the following skills:

• 3–5 years of hands-on experience as an analyst in a Security Operations Center (SOC), including at least 1–2 years at L2 or in incident response — required; IT support or NOC experience alone does not qualify
• Experience with FortiSIEM (searches, correlation rules, parsers); FortiSOAR (case handling, playbook building); Microsoft Defender XDR and Defender for Endpoint; KQL advanced hunting; MITRE ATT&CK; incident containment
• Deep networking and security knowledge: TCP/IP, DNS, firewalls (FortiGate a plus), proxies, VPN and packet analysis
• Experience with Windows and Linux log analysis, Active Directory and Entra ID sign-in logs
• A passion for turning recurring manual work into tuned detections and automated playbooks
• An undying concern about detection gaps and threats that slip past the queue
• Fluent in English (written and spoken) – bilingual or near-native level
• Strong interpersonal and communication skills – this is a client-facing role that involves frequent interaction via email, calls, and meetings

Ideally you have…

• A degree in Cybersecurity, Information Technology, or a related field
• Scripting for automation and analysis — Python, PowerShell, REST APIs
• Experience with Microsoft Sentinel, Defender for Cloud or Defender for Cloud Apps; MSSP or multi-tenant SOC experience
• Certifications such as Microsoft SC-200, Fortinet FCP / NSE 5 (FortiSIEM or FortiSOAR), CompTIA CySA+, GCIH, GCIA, or BTL1 / BTL2

#LI-Onsite

Pay Range 60 - 75 USD