Security Operations Center Analyst (L2)

Arcus Search; Köln; Hybrid; EUR 90,000 - 124,000; Full time

Job summary

Arcus Search is seeking an experienced L2 SOC Analyst for a 6-month contract, hybrid in Germany (Cologne region). You will monitor, detect, and respond to security incidents with a strong emphasis on Microsoft Defender and Microsoft Sentinel.

The role involves threat hunting, incident investigation, and collaboration with IT and security teams to remediate vulnerabilities. You will work on improving detections, playbooks, and use cases, ensuring incidents are documented and resolved in line with

Qualifications

• Proven experience as an L2 SOC Analyst or similar role.
• Hands-on with Microsoft Sentinel SIEM and Defender suite.
• Experience with EDR/SIEM/SOAR tools and threat hunting.
• Strong understanding of incident lifecycle and response processes.
• Experience analyzing logs from network, endpoint, and cloud sources.
• Knowledge of MITRE ATT&CK framework.

Responsibilities

• Monitor and triage security alerts and incidents using Microsoft Sentinel and Defender.
• Investigate security events and identify root causes; suggest remediation.
• Escalate complex incidents to L3 with proper documentation and handover.
• Conduct threat hunting to identify potential risks.
• Maintain and improve detections, playbooks, and use cases in Sentinel.
• Respond to incidents per SLA and security procedures.
• Collaborate with IT and security teams to remediate issues.
• Produce incident reports and documentation.
• Support ongoing SOC process improvements.

Skills

L2 SOC Analyst experience

Incident response

Threat hunting

Root cause analysis

Documentation

Collaboration

Networking fundamentals

Tools

Microsoft Sentinel

Microsoft Defender

EDR

SIEM

SOAR

KQL

Job description

L2 SOC Analyst

Location: Hybrid (1 day per week onsite in Cologne)

Duration: 6 months initial with scope for extension

Rate: €65 - €90 per hour depending on experience

Role Overview

We are seeking an experienced L2 SOC Analyst to support our Insurance client’s Security Operations Centre (SOC). The successful candidate will play a key role in monitoring, detecting, and responding to security incidents, with a strong focus on Microsoft security technologies, including Microsoft Defender and Microsoft Sentinel.

This is an initial 6-month contract with potential for extension, offering the opportunity to work in a dynamic, security-focused environment within the insurance sector.

Key Responsibilities

• Monitor and triage security alerts and incidents using Microsoft Sentinel and Microsoft Defender suite
• Perform detailed investigation and analysis of security events, identifying root causes and recommending remediation actions
• Escalate complex incidents to L3 teams where required, ensuring proper documentation and handover
• Conduct threat hunting activities to proactively identify potential security risks
• Maintain and improve detection rules, playbooks, and use cases within Microsoft Sentinel
• Respond to incidents in line with defined SLAs and security procedures
• Collaborate with IT, infrastructure, and application teams to remediate vulnerabilities and security issues
• Produce clear and concise incident reports and documentation
• Support continuous improvement of SOC processes, tooling, and workflows

Required Skills & Experience

• Proven experience working as an L2 SOC Analyst or similar role
• Hands-on experience with:
• Microsoft Sentinel (SIEM)
• Microsoft Defender (Endpoint, Identity, Cloud Apps, Office 365)
• Strong understanding of security incident lifecycle and response processes
• Experience analysing logs from various sources (network, endpoint, cloud)
• Knowledge of common attack vectors, threat actors, and MITRE ATT&CK framework
• Familiarity with KQL (Kusto Query Language) for querying and detection tuning
• Experience with security tools such as EDR, SIEM, and SOAR platforms
• Understanding of networking fundamentals (TCP/IP, DNS, firewalls)
• Strong analytical and problem-solving skills