Officer SOC L2

Raqami Islamic Digital Bank Ltd.; Karachi Division; Presencial; PKR 1.800.000 - 3.200.000; Jornada completa

Descripción de la vacante

Raqami Islamic Digital Bank Ltd. is seeking an Officer SOC L2 to support investigation, containment, and resolution of cybersecurity incidents escalated from SOC L1. You will help detect threats, minimise business impact, and protect information assets in line with SBP, ISO/IEC 27001, and internal policies.

The role requires hands-on incident analysis and coordination with cross-functional teams. The position involves 24x7 SOC coverage, potential shift rotations, and collaboration with IT,

Formación

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or related field.
• Certifications such as CompTIA CySA+ and Security+ preferred.

Responsabilidades

• Investigate and analyse security alerts escalated by SOC L1 to identify genuine threats and incidents.
• Conduct in-depth investigations of cybersecurity incidents including malware, phishing, account compromise, and data exfiltration.
• Correlate security logs across SIEM, EDR/XDR, email security, firewalls, AD, and other platforms to support analysis.
• Assist in containment actions like endpoint isolation and blocking malicious IPs in coordination with teams.
• Collect, preserve, and analyse digital evidence with proper documentation and chain of custody.
• Support root cause analysis of initial access vectors, attacker activities, and IOCs.
• Participate in threat hunting using threat intel, SIEM queries, and MITRE ATT&CK techniques.
• Coordinate with IT and other teams for containment, eradication, recovery, and remediation.
• Escalate critical incidents per procedures; help improve incident response playbooks and detection rules.
• Prepare incident reports with timelines, impact, and recommendations; maintain tickets and evidence.

Conocimientos

QRadar SIEM

EDR/XDR

Incident response

Threat hunting

Digital forensics

Educación

Bachelor's degree in CS/InfoSec

CySA+/Security+ preferred

Herramientas

QRadar

EDR/XDR tools

Descripción del empleo

Job Title: Officer SOC L2

Department: Information Security

Job Overview

To support and assist in the investigation, containment, and resolution of cybersecurity incidents escalated from SOC L1, helping to detect genuine threats, minimise business impact, and protect the bank’s information assets, in line with approved incident response procedures, SBP cybersecurity requirements, ISO/IEC 27001, and Raqami’s information security policies.

Key Responsibilities

• Assist in investigating and analysing security alerts escalated by SOC L1 to identify genuine threats and security incidents, under the guidance of senior SOC / incident response team members.
• Support in-depth investigation of cybersecurity incidents, including malware infections, phishing attacks, account compromise, unauthorized access, privilege escalation, lateral movement, and data exfiltration, and assist in assessing incident severity, scope, business impact, and potential exposure of the bank’s information assets.
• Assist in correlating security logs and events across SIEM (e.g., IBM QRadar), EDR/XDR, email security, firewalls, Active Directory, and other security platforms to support incident analysis.
• Support the execution of authorized incident containment actions, including endpoint isolation, blocking malicious IPs/domains, and disabling compromised accounts, in coordination with relevant teams, and assist in incident response activities in accordance with approved procedures and playbooks.
• Assist in collecting, preserving, and analysing digital evidence while maintaining proper documentation and chain of custody, where applicable.
• Support root cause analysis to identify the initial access vector, attacker activities, affected systems, and security control gaps, and assist in identifying and analysing indicators of compromise (IOCs), including malicious IP addresses, domains, URLs, file hashes, and suspicious processes.
• Assist in threat hunting activities using threat intelligence, SIEM queries, endpoint telemetry, and MITRE ATT&CK techniques to identify suspicious activities not detected by existing controls.
• Coordinate with IT, Network, Infrastructure, Cloud, and Application teams to support incident containment, eradication, recovery, and remediation, and assist in monitoring remediation activities and validating that identified threats have been contained and resolved.
• Escalate critical and high‑severity incidents to the SOC Manager and Head of Information Security Operations in accordance with established escalation procedures.
• Contribute to the development and improvement of incident response playbooks, detection rules, correlation logic, and investigation procedures in coordination with the SOC Manager, and support SOAR automation and continuous improvement of security monitoring and incident response capabilities.
• Assist in preparing incident reports documenting investigation findings, timelines, impact, root cause, containment actions, and recommendations, and maintain incident tickets, evidence, and response records in accordance with internal policies and regulatory requirements.
• Support compliance with applicable SBP cybersecurity requirements, ISO/IEC 27001, and the bank’s Information Security policies and procedures; participate in security incident simulations, tabletop exercises, and continuous improvement initiatives; and perform duties in a 24×7 SOC environment, including rotational shifts and incident response outside normal working hours, when required.

Experience & Qualification Required

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or a related field. Relevant certifications such as CompTIA CySA+ and Security+ will be preferred.
• Minimum 2-3 years of relevant experience in SOC operations, incident response, or cybersecurity operations, with hands‑on experience in L2 incident investigation. Experience in a banking or regulated financial institution is preferred.

Skills & Competencies

• Hands‑on experience with SIEM platforms such as IBM QRadar.
• Practical experience with EDR/XDR, endpoint investigation, email security, Windows/Linux logs, and network security monitoring.
• Strong understanding of the incident response lifecycle, malware analysis fundamentals, phishing investigation, threat hunting, and digital forensics.
• Working knowledge of MITRE ATT&CK, TCP/IP, DNS, HTTP/S, Active Directory, authentication mechanisms, firewalls, and common attack techniques.
• Experience in incident containment, root cause analysis, IOC analysis, and coordination with technical teams for remediation.
• Awareness of SBP cybersecurity requirements, ISO/IEC 27001, and the bank’s Information Security policies and procedures.

Raqami Bank is an equal opportunity employer. We welcome applications from all qualified individuals, including Persons with Disabilities (PWDs), and are committed to fostering an inclusive workplace where everyone has the opportunity to succeed.

Last date to apply: November 13, 2026.