SOC L2 Specialist - (Saudi National Only)

Müller`s Solutions; Riyadh; On-site; SAR 180,000 - 260,000; Full time

Job summary

Müller’s Solutions is seeking an experienced SOC L2 Specialist to deliver managed security operations, handle escalated alerts, lead incident response, and supervise day-to-day SOC activity.

You will investigate, triage, and resolve alerts, while mentoring L1 analysts and producing detailed incident reports for stakeholders. A strong SIEM background and threat-hunting skills are required.

Qualifications

• Bachelor's degree in cybersecurity, CS, IT or related field.
• 4–6 years in a SOC, with at least 2 years at L2 level.
• Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar)
• Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms
• Solid knowledge of MITRE ATT&CK, cyber kill chain, malware analysis basics and network protocols
• Experience in an enterprise or managed SOC (MSSP) environment
• Saudi national, fluent in Arabic and English
• Willing to support on-call or shift rotation if required

Responsibilities

• Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning
• Lead incident response: containment, eradication, recovery and root cause analysis
• Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats
• Tune SIEM correlation rules and use cases to reduce false positives
• Run threat hunting based on threat intelligence and MITRE ATT&CK
• Create and maintain incident response playbooks and SOAR workflows
• Supervise and mentor L1 analysts, review their work, and manage shift handovers
• Write incident reports and present findings to technical and management stakeholders
• Report incidents in line with NCA requirements and SMC's escalation matrix
• Track SOC KPIs such as MTTD, MTTR and SLA compliance

Skills

Incident response

Threat hunting

SIEM knowledge

Team mentoring

On-call rotation

MITRE ATT&CK

Education

Bachelor's degree in Cybersecurity, Computer Science, IT or related field

Tools

Splunk

IBM QRadar

Microsoft Sentinel

CrowdStrike

Defender for Endpoint

SentinelOne

SOAR platforms

Job description

Role Summary

The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity.

Key Responsibilities

• Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning
• Lead incident response: containment, eradication, recovery and root cause analysis
• Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats
• Tune SIEM correlation rules and use cases to reduce false positives
• Run threat hunting based on threat intelligence and MITRE ATT&CK
• Create and maintain incident response playbooks and SOAR workflows
• Supervise and mentor L1 analysts, review their work, and manage shift handovers
• Write incident reports and present findings to technical and management stakeholders
• Report incidents in line with NCA requirements and SMC's escalation matrix
• Track SOC KPIs such as MTTD, MTTR and SLA compliance.

• Bachelor's degree in Cybersecurity, Computer Science, IT or related field
• 4–6 years in a SOC, with at least 2 years at L2 level
• Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar)
• Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms
• Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols
• Experience in an enterprise or managed SOC (MSSP) environment
• Saudi national, fluent in Arabic and English
• Willing to support on-call or shift rotation if required

Preferred Certifications

GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification