SOC L2 Analyst: Incident Response & Threat Analysis

NTT DATA, Inc.; Birmingham; On-site; GBP 45,000 - 65,000; Full time

Job summary

NTT DATA, Inc. is seeking a SOC Analyst (L2) for a UK-based 24/7 Security Operations Centre. The role focuses on in-depth analysis, incident validation, and coordinated response to security incidents escalated from L1 teams.

You will investigate alerts using SIEM tools, guide L1 analysts during live incidents, and contribute to improving detection logic and response effectiveness. Collaboration with IT and security teams is essential.

Qualifications

• Hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, or QRadar.
• Strong analytical thinking and decision-making in high-pressure incidents.
• 2-4 years' IT security experience, ideally within a SOC or NOC environment.
• Relevant cybersecurity certifications desirable (e.g. GIAC, CySA+, SC-200).
• Experience working with cloud platforms such as Microsoft Azure and/or AWS.
• Proficiency with Microsoft Office tools, particularly Excel and Word.

Responsibilities

• Investigate alerts and events escalated from Level 1 analysts, validating and classifying incidents.
• Coordinate and support containment, eradication, and recovery actions.
• Follow major incident procedures and escalate to stakeholders as needed.
• Provide technical guidance to L1 analysts during live incidents.
• Execute defined SOAR playbooks and feedback for automation improvements.
• Maintain investigation records, runbooks, and post-incident reports.
• Collaborate with IT and security teams to resolve incidents and reduce risk.

Skills

SIEM platforms

Incident response

L2 escalation

Azure cloud

AWS cloud

Communication skills

Tools

Splunk

Microsoft Sentinel

QRadar

Excel

Word

Job description

NTT DATA, Inc. is seeking a SOC Analyst (L2) for a UK-based 24/7 Security Operations Centre. The role focuses on in-depth analysis, incident validation, and coordinated response to security incidents escalated from L1 teams.

You will investigate alerts using SIEM tools, guide L1 analysts during live incidents, and contribute to improving detection logic and response effectiveness. Collaboration with IT and security teams is essential.