Level 2 SOC Analyst: Incident Response Lead

GCP Australia IT; Melbourne; On-site; AUD 80,000 - 100,000; Full time

Job summary

GCP Australia IT is seeking a Level 2 SOC Analyst to own escalated security alerts and drive incident response across endpoint, identity, email, network and cloud environments. You will investigate threats, coordinate containment and improve detection capabilities in collaboration with security engineers and IT teams.

The ideal candidate will have hands-on experience with SIEM/EDR platforms (Microsoft Sentinel, Splunk, Defender or CrowdStrike), strong investigative judgment, and the ability to

Qualifications

• Practical experience in a SOC or incident response role, including handling Level 2 escalations.
• Ability to investigate threats across multiple domains (endpoint, identity, email, network, cloud).
• Strong investigative judgement and incident coordination skills.
• Clear written and verbal communication to non-technical stakeholders.

Responsibilities

• Investigate escalated alerts, distinguish malicious activity from false positives and assess incident severity.
• Lead assigned investigations into phishing, malware, compromised accounts, suspicious access and other security incidents.
• Analyse SIEM events, endpoint telemetry, authentication logs and network activity to establish incident scope and timelines.
• Coordinate containment, eradication and recovery actions with the relevant teams.
• Document findings, preserve relevant evidence and provide clear incident updates.
• Conduct threat hunting and identify activity related to persistence, lateral movement and data exfiltration.
• Improve detection rules, response playbooks and investigation procedures.
• Support Level 1 analysts through technical guidance and feedback.

Skills

SOC Analyst

Incident Response

Threat Investigation

Communication

Tools

Microsoft Sentinel

Splunk

Microsoft Defender

CrowdStrike

Job description

GCP Australia IT is seeking a Level 2 SOC Analyst to own escalated security alerts and drive incident response across endpoint, identity, email, network and cloud environments. You will investigate threats, coordinate containment and improve detection capabilities in collaboration with security engineers and IT teams.

The ideal candidate will have hands-on experience with SIEM/EDR platforms (Microsoft Sentinel, Splunk, Defender or CrowdStrike), strong investigative judgment, and the ability to