SOC Analyst - Level 2

Evolution Cloud Services (EVOCS); Dadri; Remote; INR 1,200,000 - 1,800,000; Full time

Job summary

Evolution Cloud Services (EVOCS) seeks an L2 SOC Analyst to join a client security operations team. You will perform triage, investigations, and escalation within the client’s SOC, interpreting alerts and defending a view with evidence collected.

You will monitor Adlumin SIEM and SentinelOne EDR, maintain case records, produce shift handovers, and work the North America night-to-morning window from India. Immediate availability is expected; unsocial shifts are a core requirement.

Qualifications

• 2–4 years in a Security Operations Centre with at least 1 year at L2 performing genuine investigations.
• Hands-on SIEM and EDR experience; product specifics matter less than investigative method.
• Knowledge of MITRE ATT&CK framework and common attack patterns.
• Disciplined case documentation and clear written English for handovers.
• Willingness to work the unsocial shift pattern described; immediate availability.

Responsibilities

• Monitor alerts and telemetry across your shift in Adlumin SIEM and SentinelOne EDR.
• Triage and carry out first-line investigation: validate the alert, enrich it, rule out false positives, and assess severity.
• Escalate confirmed or suspected incidents through the client’s escalation path with evidence.
• Execute documented client runbooks within the authority those runbooks grant to an L2 analyst.
• Maintain case and ticket records in the client’s system of record: actions taken and outcomes.
• Produce a written shift report and handover to the incoming analyst.
• Join client shift-change and operational calls during your shift.

Skills

SIEM experience

EDR experience

MITRE ATT&CK knowledge

Written English

Shift pattern willingness

Tools

Adlumin

SentinelOne

Job description

About The Role

EVOCS is hiring

About The Role

EVOCS is hiring SOC Analysts at Level 2 (L2) to extend a client's security monitoring coverage into North America evening, weekend and public holiday periods, working alongside the client's existing analysts. You will work inside the client's established Security Operations Centre: their tooling, their runbooks, their severity criteria and their escalation paths. The job is to catch what matters, work it properly, and hand it over cleanly to the next shift. This is a triage and investigation role, not an alert-routing role. You will be expected to form a view on what an alert actually means, and to defend that view with the evidence you gathered.

02 What You Will Do

• Monitor security alerts and telemetry across your shift in Adlumin (Security Information and Event Management, SIEM) and SentinelOne (Endpoint Detection and Response, EDR).
• Triage and carry out first-line investigation: validate the alert, enrich it, rule out false positives, and assess severity against the client's criteria.
• Escalate confirmed or suspected incidents through the client's escalation path, with the evidence gathered during triage attached, not simply the alert reference.
• Execute documented client runbooks within the authority those runbooks grant to an L2 analyst.
• Maintain case and ticket records in the client's system of record: actions taken, evidence and outcome for every alert handled.
• Produce a written shift report and a handover to the incoming analyst at the end of every shift, covering open investigations, escalations raised and anything carried forward.
• Join client shift-change and operational calls that fall within your scheduled shift.

Where the role stops

Incident command, containment and remediation decisions, digital forensics, threat hunting, detection engineering and platform tuning all remain with the client. You elevate; you do not decide. Being disciplined about that boundary matters more in this role than it would in an internal SOC.

03 What We Are Looking For

Essential

• Two to four (2-4) years in a Security Operations Centre, of which at least one (1) year at Level 2 performing genuine investigation rather than alert routing.
• Hands-on experience with a SIEM platform and an EDR platform. The specific products matter less
• than your investigative method.
• Working knowledge of the MITRE ATT&CK framework, common attack patterns, and how to distinguish a real detection from noise.
• Disciplined case documentation, and written English strong enough that your handover is usable by someone who was not on your shift.
• Genuine willingness to work the unsocial shift pattern described below. This is the substance of the role, not an occasional request.
• Immediate availability, with no notice period to serve.

Desirable

• Direct experience with Adlumin or SentinelOne.
• CompTIA CySA+ or Security+, GIAC GCIA, or Microsoft SC-200.
• Exposure to data centre, critical infrastructure or operational technology environments.
• Experience working inside a client's SOC rather than your own employer's, including the professional judgement that comes with it.

04 Shift Pattern and Engagement Terms

Five scheduled shifts per week of eight hours each, forty hours per week. Shifts cover North America evening, weekend and public holiday periods, which places them largely in the early morning to midday India Standard Time (IST) window. Weekend and public holiday shifts are part of the roster, not exceptions to it. The roster is fixed before the engagement begins and held for its duration. It is agreed with the client in advance, and shifts are rostered in accordance with applicable working-time and public holiday law.