Level 2 Security Operations Center (SOC) Engineer
Future Opportunity — Not Currently Hiring
Position Overview
NOCDOC is seeking an experienced Level 2 Security Operations Center (SOC) Engineer to join our Cybersecurity Operations team. This role serves as the primary technical escalation point for security incidents identified by Level 1 SOC Analysts and is responsible for advanced investigation, incident response support, security analysis, and operational improvement across a diverse portfolio of managed security customers.
As a Level 2 SOC Engineer, you will investigate complex security events, validate threats, perform root cause analysis, support containment and remediation activities, and improve the effectiveness of security monitoring operations. You will work closely with Level 1 SOC Analysts, Level 3 SOC Engineers, infrastructure teams, network engineers, automation engineers, and customer IT teams to protect customer environments from modern cyber threats.
The ideal candidate has strong cybersecurity operations experience, enjoys investigating complex security events, and thrives in a fast-paced Managed Security Services Provider (MSSP) environment. This role requires technical depth, strong analytical ability, excellent documentation practices, and the ability to communicate effectively with both technical teams and customers.
This position may be performed remotely or from one of our office locations. Candidates must be comfortable supporting a 24×7 Security Operations Center, including participation in scheduled on-call, evening, weekend, and holiday rotations as required.
Key Responsibilities
Security Investigation & Incident Response
- Answer incoming phone calls for escalated security incidents, providing direct technical support and coordination as needed
- Own escalated security tickets through to resolution, ensuring accurate documentation, timely updates, and SLA compliance
- Investigate and resolve security incidents escalated from Level 1 SOC Analysts
- Perform advanced analysis of security events generated by SIEM, EDR/XDR, IDS/IPS, firewalls, cloud platforms, identity providers, and endpoint security solutions
- Validate alerts, identify false positives, determine severity, and recommend appropriate containment, remediation, and recovery actions
- Conduct endpoint investigations involving malware, ransomware, phishing, unauthorized access, insider threats, and account compromise
- Perform log analysis across Windows, Linux, cloud platforms, Microsoft 365, firewalls, VPNs, and network infrastructure
- Analyze security telemetry from endpoint, identity, network, and cloud environments
- Execute incident response playbooks and support forensic evidence collection when appropriate
- Coordinate security incident response activities with customers, vendors, and internal technical teams
Threat Detection & Security Operations Improvement
- Correlate security events using threat intelligence, Indicators of Compromise (IOCs), MITRE ATT&CK, and other security analysis methodologies
- Participate in proactive threat hunting activities to identify emerging threats and suspicious behaviors
- Tune SIEM correlation rules, detection logic, alert thresholds, and workflows in partnership with senior SOC engineers
- Identify opportunities to improve detection coverage, investigation efficiency, and operational processes
- Support security control validation activities aligned with frameworks such as CIS Controls, NIST Cybersecurity Framework, and industry best practices
- Assist with vulnerability remediation efforts by validating security findings and coordinating with infrastructure teams to reduce organizational risk
Technical Documentation & Knowledge Sharing
- Develop and maintain Standard Operating Procedures (SOPs), incident response playbooks, knowledge base articles, and technical documentation
- Document investigations, analysis findings, response actions, and lessons learned
- Participate in post-incident reviews and root cause analysis to improve security operations and customer outcomes
- Mentor Level 1 SOC Analysts through technical guidance, investigation reviews, and knowledge sharing
- Support continuous improvement of SOC processes, procedures, and operational maturity
Cross-Functional Collaboration
- Collaborate with NOC, Service Desk, Infrastructure, Engineering, Compliance, and Customer Success teams during security events
- Communicate security findings and recommendations clearly to technical teams and customer stakeholders
- Provide technical input into security improvements, operational processes, and service enhancements
Required Qualifications
- 3–5 years of experience in a Security Operations Center (SOC), Managed Security Services Provider (MSSP), Incident Response, or cybersecurity operations role
- Experience investigating security incidents across endpoint, identity, network, and cloud environments
- Experience working with SIEM platforms, EDR/XDR solutions, Microsoft Defender XDR, Microsoft Sentinel or comparable SIEM platforms, Active Directory and Microsoft Entra ID, and Microsoft 365 security technologies
- Strong understanding of TCP/IP networking, DNS, DHCP, VPN technologies, firewalls, authentication protocols, and endpoint security concepts
- Experience analyzing Windows Event Logs, Syslog, authentication logs, and security telemetry
- Understanding of MITRE ATT&CK Framework, Cyber Kill Chain concepts, and Indicators of Compromise (IOCs)
- Understanding of security frameworks and control concepts including CIS Controls, NIST Cybersecurity Framework, or similar standards
- Strong analytical, troubleshooting, and incident response skills
- Excellent written and verbal communication skills
- Ability to manage multiple security investigations while meeting customer SLA requirements
Preferred Qualifications
- Experience working in a Managed Security Services Provider (MSSP)
- Experience supporting cloud security environments in Microsoft Azure or AWS
- Experience with Microsoft Sentinel, Splunk Enterprise Security, IBM QRadar, LogRhythm, or similar SIEM platforms
- Experience with Microsoft Defender XDR, CrowdStrike Falcon, SentinelOne, Cortex XDR, or comparable endpoint detection platforms
- Familiarity with SOAR platforms and security automation workflows
- Experience with vulnerability management platforms such as Tenable, Qualys, or Rapid7
- Experience performing threat hunting and detection engineering activities
- Experience improving security monitoring capabilities through tuning and operational improvements
- Basic scripting experience using PowerShell, Python, KQL, or similar technologies
- Experience supporting compliance-driven security environments
Foundational Security
- CompTIA Security+
- ISC2 Certified in Cybersecurity (CC)
- CompTIA CySA+
Microsoft Security
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)
Advanced Security
- Blue Team Level 1 (BTL1)
- GIAC Certified Incident Handler (GCIH)
- GIAC Certified Intrusion Analyst (GCIA)
- Splunk Core Certified Power User
- Microsoft Defender XDR Ninja or equivalent vendor training
Technical Skills
Security Operations
- Incident Response
- Threat Detection
- Threat Hunting
- Security Monitoring
- Malware Analysis
- Phishing Investigations
- Root Cause Analysis
- IOC Analysis
- MITRE ATT&CK Framework
- Cyber Kill Chain Concepts
- Security Control Validation
- CIS Controls Awareness and Application
Security Platforms
- Microsoft Sentinel
- Microsoft Defender XDR
- Microsoft Defender for Endpoint
- Microsoft Defender for Office 365
- Microsoft Entra ID
- SIEM Platforms
- EDR/XDR Platforms
- IDS/IPS
- Firewalls
- Email Security Technologies
- SOAR Platforms
Infrastructure
- Windows Server
- Windows 10/11
- Linux
- Active Directory
- Microsoft 365
- Azure
- TCP/IP
- DNS
- DHCP
- VPN
Professional Skills
- Critical Thinking
- Incident Documentation
- Customer Communication
- Technical Writing
- Team Collaboration
- Mentoring
- Time Management
- Problem Solving
- Continuous Improvement Mindset
Career Growth Opportunity
This position provides a clear path toward Level 3 SOC Engineer, Incident Response Engineer, Threat Hunter, Detection Engineer, Security Engineer, Digital Forensics & Incident Response (DFIR) Engineer, Cloud Security Engineer, or Security Architect.
Engineers gain hands-on experience with enterprise security platforms, advanced incident response, threat hunting, security control validation, detection improvement, cloud security, automation, and emerging cybersecurity technologies while protecting customer environments across diverse industries.
Schedule
- Day, evening, overnight, weekend, and holiday shifts as scheduled
- Participation in an on-call rotation
- Occasional overtime during active security incidents
Benefits
About NOCDOC
NOCDOC is a U.S.-based technology operations company with more than 35 years of experience delivering Security Operations Center (SOC), Network Operations Center (NOC), Service Desk, Network Engineering, Automation, and Managed Security Services.
Supporting organizations across North America and internationally, NOCDOC delivers responsive, customer-focused technology operations that help businesses improve reliability, security, and operational efficiency.
At NOCDOC, we invest in our people through continuous learning, mentorship, and career development, providing opportunities to grow into advanced engineering, automation, architecture, and technical leadership roles.