SOC Security Analyst L2

BlueVoyant; Maryland Park (MD); Ibrido; USD 75.000 - 110.000; Tempo pieno

Descrizione del lavoro

BlueVoyant is seeking a SOC Security Analyst Level 2 to join our Security Operations Center on a hybrid schedule in Maryland. You will own security alerts, investigate incidents, and escalate complex issues to L3 with well-documented findings.

You will work with senior analysts and clients, applying SIEM, EDR, and cloud security tools to reduce dwell time and impact. Strong communication and teamwork are essential for success.

Competenze

• Bachelor’s degree or equivalent experience in IT security.
• Experience handling high-volume ticket queues with accuracy.
• Familiarity with SIEM tools and EDR technologies required.

Mansioni

• Monitor, triage, and investigate security alerts and tickets from multiple sources.
• Own assigned tickets through to resolution within SLAs.
• Document investigation steps, findings, and actions in ticketing system.
• Take initial response actions per runbooks and client procedures.
• Communicate with clients for updates and remediation guidance.
• Identify false positives and tune detections; contribute to runbooks.

Conoscenze

SIEM workflows

EDR analysis

Threat hunting

Incident response

Client communication

Team collaboration

Formazione

Bachelor's degree in Information Security/CS

Strumenti

Microsoft Sentinel

Splunk

Microsoft Defender suite

CrowdStrike Falcon

SentinelOne

Descrizione del lavoro

Position: SOC Security Analyst L2

Reports To: SOC Team Lead

Department: Security Operations Center (SOC)

Location: Hybrid, Maryland

Shift Requirement: : 4x 10 Hour Shifts. Wednesday - Saturday or Sunday - Tuesday. Exact shift timings TBC

Work Authorization: US Citizenship Required

BlueVoyant is seeking a SOC Security Analyst L2 to join our Security Operations Center, defending our global customers against constant and evolving adversary activity. In this role you will own and work through a queue of security alerts and tickets, carrying out thorough investigations, resolving cases accurately and efficiently, and escalating confirmed or complex incidents to L3 analysts with clear, well-documented findings. You will work closely with senior analysts and clients to reduce the impact and dwell time of security incidents. This role reports into BlueVoyant SOC leadership and operates under BlueVoyant processes, tooling, and supervision at all times, including when working within client environments.

What You'll Do

• Monitor, triage, and investigate security alerts and tickets from multiple sources, including SIEM logs, endpoint logs, and EDR telemetry.
• Own assigned tickets through to resolution, working within defined SLAs and prioritizing by severity and client impact.
• Research indicators and activities to determine reputation and suspicious attributes.
• Perform analysis of suspicious files, emails, URLs, and attacker infrastructure to support investigations.
• Determine whether activity is malicious, benign, or a false positive, and elevate confirmed or complex incidents to L3 analysts with clear supporting evidence.
• Document investigation steps, findings, and recommended actions accurately within the ticketing and case management system.
• Take initial response actions in line with runbooks and client-approved procedures, such as isolating endpoints or disabling compromised accounts.
• Communicate with clients to provide ticket updates, request information, and share remediation guidance.
• Identify false-positive or benign detections and recommend tuning improvements.
• Contribute to the improvement of runbooks, procedures, and automation.
• Support and share knowledge with L1 analysts and incorporate feedback from L3 peer review and QA.
• Operate across BlueVoyant-managed systems and client-provided environments in accordance with client-approved access controls, logging, and BlueVoyant operating procedures, maintaining strict separation and adherence to security policies.

What You'll Bring

• Ability to manage a high-volume ticket queue in a fast-paced environment while maintaining accuracy and attention to detail.
• Strong written and verbal communication skills, with the ability to document findings clearly and explain technical issues in easy-to-understand language.
• Strong teamwork and interpersonal skills, including working effectively within a globally distributed team.
• Ability to work directly with clients to provide updates and gather information.
• Knowledge and experience with SIEM solutions, Cloud App Security tools, and EDR.
• Experience in endpoint, web, email, and authentication log analysis.
• Solid understanding of network protocols and network telemetry.
• Knowledge of common attack techniques, including phishing, business email compromise (BEC), credential harvesting, LOLBin use, and lateral movement.
• Working knowledge of:
• SIEM workflows (preferably Microsoft Sentinel and Splunk)
• Microsoft 365 and Entra ID security alerts and sign-in logs
• Email security and phishing analysis
• Network monitoring metadata (web logs, firewall logs, WAF/IDS)
• Windows and Unix operating system fundamentals and common forensic artifacts
• Ticketing and case management systems
• Ability to successfully complete a background check and any client-required security vetting.

Nice to Have

• 3+ years of hands-on SOC/TOC/NOC experience.
• Experience in an MSSP/MSP environment supporting multiple clients.
• Basic malware analysis or sandboxing experience.
• Experience writing SIEM queries (KQL or SPL).
• Familiarity with Microsoft Sentinel, Splunk, Microsoft Defender suite, CrowdStrike Falcon, and SentinelOne.
• Understanding of a scripting language such as Python or PowerShell.
• Relevant certifications such as: Security+, CySA+, Network+, GIAC (e.g. GSEC, GCIH), Microsoft SC-200, CEH

Education

• Bachelor's degree in Information Security, Computer Science, or another IT-related field, or equivalent professional experience.

Why BlueVoyant?

• Investigate real-world threats across a diverse global client base, building hands-on experience with leading Microsoft Security, SIEM, and EDR technologies.
• Develop your skills alongside senior L3 analysts and incident responders, with clear opportunities to grow toward advanced investigation and response.
• Join a global, mission-driven cybersecurity company defending organizations worldwide with cutting-edge data, technology, and expertise.
• Competitive compensation and a comprehensive benefits package, with support for wellbeing, development, and career growth.

About BlueVoyant

BlueVoyant is an AI-driven cybersecurity company dedicated to standing between our customers and cyber threats. By combining human, artificial, and proprietary intelligence, we deliver a unified solution that protects every organization's network, identities, vendors, and digital footprints as a single attack surface. The company's award-winning Microsoft Security expertise helps organizations maximize their security investments while reducing risk and ensuring compliance.

Led by CEO, John Hernandez, BlueVoyant's highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.

Founded in 2017 by Fortune 500 executives, including Chairman of the Board, Jim Rosenthal, Vice Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, London, Budapest, and Latin America and is committed to building a workplace where talented people are empowered to do their best work in the fight against global cyber threats.

All employees must be authorized to work in the United States of America. BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, or genetics. In addition to federal law requirements, BlueVoyant complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities.

Disclaimer: Please note that pursuant to contractual requirements and applicable law, for employees to perform work on some of the company’s federal contracts, U.S. citizenship is required. Accordingly, an employee’s ability to perform work on such contracts is contingent upon the company’s verification of the employee’s citizenship status.