Level 2 SOC Analyst

GCP Australia IT; Melbourne; Presencial; AUD 80.000 - 100.000; Jornada completa

Descripción de la vacante

GCP Australia IT is seeking a Level 2 SOC Analyst to own escalated security alerts and drive incident response across endpoint, identity, email, network and cloud environments. You will investigate threats, coordinate containment and improve detection capabilities in collaboration with security engineers and IT teams.

The ideal candidate will have hands-on experience with SIEM/EDR platforms (Microsoft Sentinel, Splunk, Defender or CrowdStrike), strong investigative judgment, and the ability to

Formación

• Practical experience in a SOC or incident response role, including handling Level 2 escalations.
• Ability to investigate threats across multiple domains (endpoint, identity, email, network, cloud).
• Strong investigative judgement and incident coordination skills.
• Clear written and verbal communication to non-technical stakeholders.

Responsabilidades

• Investigate escalated alerts, distinguish malicious activity from false positives and assess incident severity.
• Lead assigned investigations into phishing, malware, compromised accounts, suspicious access and other security incidents.
• Analyse SIEM events, endpoint telemetry, authentication logs and network activity to establish incident scope and timelines.
• Coordinate containment, eradication and recovery actions with the relevant teams.
• Document findings, preserve relevant evidence and provide clear incident updates.
• Conduct threat hunting and identify activity related to persistence, lateral movement and data exfiltration.
• Improve detection rules, response playbooks and investigation procedures.
• Support Level 1 analysts through technical guidance and feedback.

Conocimientos

SOC Analyst

Incident Response

Threat Investigation

Communication

Herramientas

Microsoft Sentinel

Splunk

Microsoft Defender

CrowdStrike

Descripción del empleo

This is an excellent opportunity to start with an Organisation Of Choice on a great contract start!!!

About the role

We are seeking a Level 2 SOC Analyst with strong investigation and incident response skills. This role suits someone who can take ownership of escalated security alerts, establish what happened and coordinate an effective response.

You will investigate threats across endpoint, identity, email, network and cloud environments, working with security engineers and IT teams to contain incidents and strengthen detection capabilities.

Key responsibilities

• Investigate escalated alerts, distinguish malicious activity from false positives and assess incident severity.
• Lead assigned investigations into phishing, malware, compromised accounts, suspicious access and other security incidents.
• Analyse SIEM events, endpoint telemetry, authentication logs and network activity to establish incident scope and timelines.
• Coordinate containment, eradication and recovery actions with the relevant teams.
• Document findings, preserve relevant evidence and provide clear incident updates.
• Conduct threat hunting and identify activity associated with persistence, lateral movement and data exfiltration.
• Improve detection rules, response playbooks and investigation procedures.
• Support Level 1 analysts through technical guidance and constructive feedback.

What you will bring

• Practical experience in a SOC or incident response role, including handling Level 2 escalations.
• Strong investigative judgement and the ability to follow an incident through to resolution.
• Hands-on experience with SIEM and EDR platforms, such as Microsoft Sentinel, Splunk, Microsoft Defender or CrowdStrike.
• Understanding of Windows environments, Active Directory, Microsoft Entra ID, networking and common attacker techniques.
• Experience investigating identity, endpoint and email security incidents.
• Ability to write effective investigation queries; familiarity with KQL or SPL is advantageous.
• Clear written and verbal communication, including the ability to explain technical findings to non-technical stakeholders.

Desirable experience

• Security investigations across Microsoft 365, Azure or AWS.
• Digital forensics, malware triage or scripting with PowerShell or Python.
• Applying MITRE ATT&CK to investigations and detection improvements.
• Relevant security certifications or equivalent practical experience.