SOC Tier 2 Analyst

CyberClan; Australia; A distancia; CAD 85.000 - 95.000; Jornada completa

Descripción de la vacante

CyberClan is seeking a T2 SOC Analyst to investigate and respond to security incidents across client environments. You will leverage SIEM, EDR, threat intelligence, and other technologies to identify, contain, and resolve threats within a 24x7 team.

The role requires willingness to work shifts including unsociable hours and bank holidays. You will work closely with SOC leadership and senior analysts to improve detection and response capabilities.

Formación

• 3+ years in a SOC, security operations, incident response, or security monitoring.
• Experience creating and executing searches in SIEM platforms.
• Strong understanding of SOC workflows, alert triage, and incident escalation.
• Hands-on with SIEM and endpoint security tools to investigate events.
• Ability to assess risk, prioritize investigations, and escalate as needed.

Responsabilidades

• Perform Tier 2 triage and investigate escalated security alerts from SIEM, EDR/XDR, and related tools.
• Correlate events across data sources to classify activity and determine incidents.
• Lead investigations across diverse client environments with SLA adherence.
• Apply MITRE ATT&CK framework to describe tactics and techniques observed.
• Document steps, findings and actions clearly in the ticketing system.
• Provide updates to stakeholders and mentor Tier 1 analysts.
• Coordinate incident response activities and handoffs to IR teams.

Conocimientos

SOC experience

SIEM

Incident response

Log analysis

Threat intel

MITRE ATT&CK

Team guidance

Educación

Bachelor's degree in CS/IT/Cybersecurity

Herramientas

Microsoft Sentinel

Splunk

QRadar

Defender XDR

CrowdStrike

Trend Vision One

Sentinel One

Descripción del empleo

CyberClan provides enterprise security, and human response to small and midsize enterprises and channel partners through comprehensive risk assessment services, 24/7/365 managed detection and response services, and lightning-fast breach response. Formerly known as Network Test Labs established in Canada and specializing in vulnerability assessments and penetration testing in the gaming industry, CyberClan has grown from three employees in 2006 in one market to over 75 employees with clients in nine countries and offices in the Australia, Canada, United Kingdom, and United States as a leading Managed Services Provider.

Our mission is to make the online world a safer and more secure place by delivering sophisticated cybersecurity solutions in a highly personalized — and human — way.

CyberClan is hiring a T2 SOC Analyst who will be responsible for investigating and responding to security incidents across client environments, leveraging SIEM, EDR, threat intelligence, and other security technologies to identify and contain threats. Acting as an escalation point for complex investigations, you will perform detailed analysis, validate indicators of compromise, support incident response activities, and help drive continuous improvements across detection and response capabilities. This role requires willingness to work shifts (including unsociable hours and bank holidays where these fall into your shift pattern) as part of a 24x7 team.

The successful candidate will work closely with the SOC Manager and the SOC Lead. The ideal candidate will have an energetic, can-do attitude and be comfortable working in a metrics-driven environment, delivering results and supporting team members.

Key Responsibilities

• Perform Tier 2 triage and investigation of escalated security alerts from SIEM, EDR/XDR, email security, identity, cloud, firewall, and other monitoring tools.
• Correlate events across multiple data sources to determine whether activity is benign, suspicious, or a confirmed security incident.
• Manage multiple concurrent investigations across diverse client environments while maintaining SLA commitments.
• Apply a working understanding of the MITRE ATT&CK framework to describe observed tactics, techniques, and procedures.
• Conduct investigation and evidence gathering, including log analysis, endpoint review, basic forensic artefact analysis, IOC enrichment, and timeline development.
• Document investigation steps, findings, impact, and recommended next actions clearly in the ticketing platform.
• Support proactive threat hunting activities through log analysis, hypothesis validation, and investigation of identified indicators.
• Leverage internal and external threat intelligence sources to enrich investigations, validate indicators, and provide contextual analysis.
• Provide clear and timely investigation updates to internal stakeholders and client stakeholders throughout the incident lifecycle.
• Provide operational oversight and guidance to Tier 1 analysts, ensuring alerts are investigated, documented, and escalated in accordance with SOC procedures and service level objectives.
• Escalate confirmed or suspected incidents to the SOC Lead and Incident Response teams in accordance with established procedures.
• Follow established playbooks, runbooks, SLAs, and escalation paths consistently.
• Contribute practical feedback to improve detection logic, playbooks, knowledge base articles, and SOC operating procedures.
• Maintain awareness of current threat activity and apply relevant context to daily investigations.
• Lead the investigation and coordination of high-priority (P1/P2) security incidents until handoff, containment, or resolution in accordance with incident response procedures.
• Perform structured investigations and root cause analysis to determine attack scope, impact, origin, and recommended response actions.
• Serve as a technical point of contact during investigations, translating complex security findings into clear and actionable information for non-technical client stakeholders.

Skills, Knowledge and Experience

• Minimum of a bachelor's degree in a relevant field (e.g., Computer Science, Information Technology, Cybersecurity) or equivalent work experience.
• 3+ years of experience working in a SOC, security operations, incident response, or security monitoring environment.
• Experience creating and executing searches, queries, and investigations within SIEM platforms.
• Strong understanding of SOC workflows, alert triage, incident escalation, and investigation documentation.
• Hands-on experience using SIEM and endpoint security tools to investigate security events.
• Demonstrated ability to assess risk, prioritize investigations, and make sound escalation decisions in fast-paced operational environments.
• Working knowledge of MITRE ATT&CK and common attacker behaviors, including phishing, credential attacks, malware, lateral movement, and command-and-control activity.
• Ability to analyze logs from Windows, Linux, network, identity, email, cloud, and endpoint sources.
• Understanding of networking fundamentals, including TCP/IP, DNS, HTTP/S, firewalls, proxy logs, and packet capture concepts.
• Ability to follow documented processes, meet programmer SLAs, and elevate appropriately when risk or uncertainty remains.
• Clear written communication skills for tickets, incident notes, and client-facing updates.
• Curious, analytical mindset with the ability to ask good questions, validate assumptions, and continue learning.

Preferred Skills and Experience

• Experience with tools such as Microsoft Sentinel, Splunk, QRadar, Defender XDR, CrowdStrike, Trend Vision One, Sentinel One, or similar platforms.
• Familiarity with KQL, SPL, Sigma, PowerShell, Python, or other query/scripting languages used in investigations.
• Exposure to basic digital forensics, malware triage, phishing analysis, or cloud security investigations.
• Relevant certification or equivalent experience, such as CompTIA Security+, CySA+, SC-200, BTL1, or GIAC security operations certifications.

Attributes

• Ability to communicate technical information to non-technical stakeholders
• Genuine enthusiasm and drive to work within cyber security
• Good written skills to write explanations of systems, regulations and or procedures
• Ability to identify and suggest continual improvement
• Good analytical and problem-solving skills
• Ability to adapt organizational change, work unsupervised & under pressure
• Proven ability to manage varied workload

Compensation

$85,000 - $95,000 CAD

A candidate's salary is determined by various factors including, but not limited to, relevant work experiences, skills, certifications & location

Job Type

Full-time

Location

100% Telecommuting

Must be authorized to work in the Australia

% of Travel Required

0-5%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.