Tier 2 SOC Analyst: Threat Hunting & Incident Response

Aristocrat Leisure; Summerlin South (NV); On-site; USD 70,000 - 110,000; Full time

Job summary

Aristocrat Leisure is seeking a Security Operations Analyst (Tier 2) to join our global SOC. You will own escalations, investigate IOCs across endpoint, identity, network, and cloud data, and help tune detections and containment playbooks.

Ideal candidates have 2+ years in a hands-on SOC, familiarity with CrowdStrike, SIEM/EDR/SOAR tooling, and a solid understanding of MITRE ATT&CK. Flexible to work in a 24x7 roster across our security teams.

Qualifications

• 2+ years of hands-on SOC / security operations experience.
• Bachelor's degree in information systems, cybersecurity, or related field, or equivalent experience.
• Familiarity with CrowdStrike, SIEM, EDR, and SOAR tooling.
• Understanding of MITRE ATT&CK and phishing/malware investigations.

Responsibilities

• Own MSSP customer concerns and medium/high-severity alerts from start to finish.
• Scope activity, build the timeline, and identify IOCs across endpoints, identity, network, and cloud.
• Triage MSSP triage for quality, tuning, gaps, and escalation criteria.
• Contain and remediate per playbooks: host isolation, credential resets, IOC blocking.
• Build and run queries across SIEM/EDR/SOAR to support investigations.
• Document cases to a high standard and support threat hunts and RCA.

Skills

SOC operations

Threat investigation

Endpoint/EDR analysis

SIEM querying (CQL/KQL)

Cloud security monitoring

Python/PowerShell scripting

MITRE ATT&CK knowledge

On-call readiness

Education

Bachelor's degree in information systems or cybersecurity

Tools

CrowdStrike

SIEM tooling

SOAR

EDR tooling

Job description

Aristocrat Leisure is seeking a Security Operations Analyst (Tier 2) to join our global SOC. You will own escalations, investigate IOCs across endpoint, identity, network, and cloud data, and help tune detections and containment playbooks.

Ideal candidates have 2+ years in a hands-on SOC, familiarity with CrowdStrike, SIEM/EDR/SOAR tooling, and a solid understanding of MITRE ATT&CK. Flexible to work in a 24x7 roster across our security teams.