Senior Cyber Fraud SOC Lead – Incident Response

Citigroup; Irving (TX); On-site; USD 90,000 - 130,000; Full time

Job summary

Citigroup is seeking an L2 SOC Analyst to perform continuous monitoring, initial triage, and in-depth analysis of security events across multiple domains. This role leads education and training for L1 analysts, mentors junior staff, and designs advanced SOC playbooks and procedures to improve incident response.

The ideal candidate has extensive experience in cyber-fraud analysis and data analytics. Responsibilities include coordinating rapid response, maintaining documentation for escalation,

Qualifications

• 6–10 years of experience in cyber-fraud analysis, incident response, or data analytics within a security context.
• Experience investigating and managing complex fraud incidents in an enterprise SOC environment.
• Strong data analytics with SQL, Python, SAS, or R for interrogating large datasets.

Responsibilities

• Perform hands-on 24x7 monitoring and triage of alerts from SIEM, EDR, IDS/IPS, and enterprise fraud tools.
• Lead Level 2 peer review of L1 analysis to ensure accuracy and adherence to procedures.
• Coordinate rapid response and containment for active fraud incidents and document actions for escalation.
• Design and implement advanced SOC playbooks and SOPs for complex cyber-fraud scenarios.
• Mentor L1 analysts and lead training to improve operational excellence.

Skills

Fraud TTPs

Data analytics

Incident response

Mentoring

24x7 operations

Education

Certified Fraud Examiner (CFE)

GIAC Certified Incident Handler (GCI)

Tools

SQL

Python

SAS

R

Job description

Citigroup is seeking an L2 SOC Analyst to perform continuous monitoring, initial triage, and in-depth analysis of security events across multiple domains. This role leads education and training for L1 analysts, mentors junior staff, and designs advanced SOC playbooks and procedures to improve incident response.

The ideal candidate has extensive experience in cyber-fraud analysis and data analytics. Responsibilities include coordinating rapid response, maintaining documentation for escalation,