SOC L2 Specialist - (Saudi National Only)

Müller's Solutions; Riyadh; On-site; SAR 180,000 - 300,000; Full time

Job summary

Müller's Solutions in Riyadh, Saudi Arabia, seeks a SOC L2 Specialist to deliver managed security operations. You will handle escalated alerts from L1, lead incident response, and supervise day-to-day SOC activity.

The role requires 4–6 years in a SOC, strong SIEM hands-on experience, and proficiency in Arabic and English. You will work in an enterprise/MSSP environment and participate in on-call rotations.

Qualifications

• Bachelor's degree in Cybersecurity, CS, IT or related field.
• 4–6 years in a SOC with at least 2 years at L2 level.
• Strong hands-on SIEM experience (Splunk, QRadar, Sentinel, etc.).
• Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR.
• Knowledge of MITRE ATT&CK, kill chain, malware basics and network protocols.
• Experience in enterprise or MSSP environment.
• Saudi national; fluent in Arabic and English.
• Willing to support on-call or shift rotation.

Responsibilities

• Investigate and triage alerts escalated from L1 analysts.
• Lead incident response: containment, eradication, recovery and root cause analysis.
• Analyze logs, network traffic, endpoint telemetry and email threats.
• Tune SIEM correlation rules and use cases to reduce false positives.
• Run threat hunting based on threat intelligence and MITRE ATT&CK.
• Create and maintain incident response playbooks and SOAR workflows.
• Supervise and mentor L1 analysts, review their work, and manage shift handovers.
• Write incident reports and present findings to technical and management stakeholders.
• Report incidents in line with NCA requirements and SMC's escalation matrix.
• Track SOC KPIs such as MTTD, MTTR and SLA compliance.

Skills

Arabic and English fluency

Mentoring L1 analysts

Education

Bachelor's degree in Cybersecurity, Computer Science, IT or related field

Tools

Splunk

IBM QRadar

Microsoft Sentinel

CrowdStrike

Defender for Endpoint

SentinelOne

SOAR platforms

Job description

Role Summary

The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity.

Key Responsibilities

• Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning
• Lead incident response: containment, eradication, recovery and root cause analysis
• Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats
• Tune SIEM correlation rules and use cases to reduce false positives
• Run threat hunting based on threat intelligence and MITRE ATT&CK
• Create and maintain incident response playbooks and SOAR workflows
• Supervise and mentor L1 analysts, review their work, and manage shift handovers
• Write incident reports and present findings to technical and management stakeholders
• Report incidents in line with NCA requirements and SMC's escalation matrix
• Track SOC KPIs such as MTTD, MTTR and SLA compliance.

• Bachelor's degree in Cybersecurity, Computer Science, IT or related field
• 4–6 years in a SOC, with at least 2 years at L2 level
• Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar)
• Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms
• Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols
• Experience in an enterprise or managed SOC (MSSP) environment
• Saudi national, fluent in Arabic and English
• Willing to support on-call or shift rotation if required

Preferred Certifications

GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification