L2 SOC / Splunk

VaporVM Ltd.; Saudi Arabia; On-site; SAR 180,000 - 320,000; Full time

Job summary

VaporVM Ltd. in Saudi Arabia is seeking an L2 SOC / Splunk Engineer to perform advanced security monitoring, incident investigation, and threat analysis.

You will work with Splunk Enterprise Security, SIEM operations, incident response, and security event correlation to escalate and resolve complex security events. The role requires hands-on experience with Splunk, developing and tuning searches, dashboards, and detection use cases; you will collaborate with L1/L3 teams, monitor KPIs, and

Responsibilities

• Perform advanced monitoring and investigation of security incidents using Splunk.
• Analyze and correlate events across multiple security and IT data sources.
• Investigate escalated incidents from L1 analysts.
• Conduct detailed root‑cause analysis of security incidents.
• Validate and investigate suspicious activities and potential threats.
• Develop and optimize Splunk searches and correlation rules.
• Review and tune existing Splunk detection use cases.
• Reduce false positives and improve detection accuracy.
• Develop and maintain dashboards and operational reports.
• Analyze: Malware activity, Phishing attempts, Account compromise, Privilege escalation, Lateral movement, Data exfiltration, Suspicious network activity, Endpoint threats.
• Perform threat hunting activities using Splunk.
• Support incident containment and remediation activities.
• Coordinate with L1 and L3 teams during major incidents.
• Prepare detailed incident investigation reports.
• Participate in incident response and crisis management activities.
• Support development and enhancement of SOC use cases.
• Monitor and maintain SOC KPIs and SLAs.
• Provide technical guidance to L1 engineers.
• Participate in 24×7 SOC shift operations when required.

Job description

Department: Security Operations Center (SOC)

Level: L2

Positions: 1

Job Summary

The L2 SOC / Splunk Engineer will be responsible for advanced security monitoring, incident investigation, threat analysis, and escalation management. The role requires strong hands‑on experience with Splunk Enterprise Security, SIEM operations, incident response, and security event correlation.

Key Responsibilities

• Perform advanced monitoring and investigation of security incidents using Splunk.
• Analyze and correlate events across multiple security and IT data sources.
• Investigate escalated incidents from L1 analysts.
• Conduct detailed root‑cause analysis of security incidents.
• Validate and investigate suspicious activities and potential threats.
• Develop and optimize Splunk searches and correlation rules.
• Review and tune existing Splunk detection use cases.
• Reduce false positives and improve detection accuracy.
• Develop and maintain dashboards and operational reports.
• Analyze:
  • Malware activity
  • Phishing attempts
  • Account compromise
  • Privilege escalation
  • Lateral movement
  • Data exfiltration
  • Suspicious network activity
  • Endpoint threats
• Perform threat hunting activities using Splunk.
• Support incident containment and remediation activities.
• Coordinate with L1 and L3 teams during major incidents.
• Prepare detailed incident investigation reports.
• Participate in incident response and crisis management activities.
• Support development and enhancement of SOC use cases.
• Monitor and maintain SOC KPIs and SLAs.
• Provide technical guidance to L1 engineers.
• Participate in 24×7 SOC shift operations when required.