SOC Analyst- Tier 2 Investigation

Madre Me; Doha; On-site; QAR 180,000 - 300,000; Full time

Job summary

Madre Integrated Engineering is seeking an experienced Security Operations Center (SOC) Analyst to monitor, investigate, and respond to security incidents from Tier 1 escalations in a dynamic Qatar environment. You will analyze logs, network traffic, and endpoint activity to identify malicious behavior and coordinate containment with IT teams.

The role requires 5–8 years in SOC, a bachelor’s in cybersecurity or related field, and certifications such as CySA+ or GCIA.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• 5-8 years of experience in Cyber Security Operations Center (SOC) environments.
• Minimum 3+ years of experience performing Tier 2 or advanced security investigations.
• Professional certification: CompTIA CySA+ (Cybersecurity Analyst) or GIAC Certified Intrusion Analyst (GCIA).
• Strong understanding of Security Incident Response, Threat Detection & Analysis, Network & Endpoint Security, Security Monitoring, Threat Intelligence.

Responsibilities

• Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
• Perform detailed analysis of security events, logs, traffic, and endpoints to identify malicious behavior.
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
• Analyze IOCs and IOAs to determine scope and impact of incidents.
• Proactively hunt threats using SIEM, EDR, and threat intel platforms.
• Investigate advanced threats, malware infections, phishing, insider threats, and anomalies.

Skills

SOC experience

Incident response

Threat detection

Threat analysis

Team mentorship

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Microsoft Sentinel

Splunk

IBM QRadar

ArcSight

Microsoft Defender

CrowdStrike

SentinelOne

Carbon Black

Job description

Madre Integrated Engineering | Full time

• Monitor, analyze, and investigate security alerts and incidents escalated from Tier 1 analysts.
  
• Perform detailed analysis of security events, logs, network traffic, and endpoint activities to identify malicious behavior.
  
• Conduct incident triage, investigation, containment, eradication, and recovery activities.
  
• Analyze Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) to determine the scope and impact of security incidents.
  
• Perform proactive threat hunting exercises using SIEM, EDR, and threat intelligence platforms.
  
• Investigate advanced threats, malware infections, phishing attacks, insider threats, and anomalous activities.
  
• Correlate events from multiple security tools to identify attack patterns and potential breaches.
  
• Develop and enhance use cases, detection rules, correlation logic, and SOC playbooks.
  
• Document investigation findings, root cause analysis, and incident reports.
  
• Collaborate with IT, infrastructure, network, and application teams during incident response activities.
  
• Support digital forensics activities and evidence collection when required.
  
• Participate in security incident response drills and continuous improvement initiatives.
  
• Mentor junior SOC analysts and provide technical guidance on complex investigations.
  

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
  
• 5-8 years of experience in Cyber Security Operations Center (SOC) environments.
  
• Minimum 3+ years of experience performing Tier 2 or advanced security investigations.
  
• Professional certification:
  • CompTIA CySA+ (Cybersecurity Analyst), or
    
  • GIAC Certified Intrusion Analyst (GCIA)
    
• Strong understanding of:
  • Security Incident Response
    
  • Threat Detection and Analysis
    
  • Network Security
    
  • Endpoint Security
    
  • Security Monitoring
    
  • Threat Intelligence
    
• Experience with enterprise SIEM platforms such as:
  • Microsoft Sentinel
    
  • Splunk
    
  • IBM QRadar
    
  • ArcSight
    
• Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, Carbon Black, or SentinelOne.