Soc Analyst - L2

Evolution Cloud Services (EVOCS)•Denver, CO

2d•$60 - $75•Onsite

About The Position

As a SOC Analyst L2, you will own escalated security incidents from investigation through containment across FortiSIEM, FortiSOAR, and Microsoft Defender XDR. You will determine root cause, lead response, improve detections and automation, and support L1 analysts who escalate cases to you. This is a client-facing role involving frequent communication through email, calls, and meetings.

Requirements

3–5 years of hands-on experience as a SOC analyst, including at least 1–2 years at L2 or in incident response; IT support or NOC experience alone does not qualify.
Experience with FortiSIEM, including searches, correlation rules, and parsers.
Experience with FortiSOAR, including case handling and playbook building.
Experience with Microsoft Defender XDR and Defender for Endpoint.
Experience with KQL advanced hunting, MITRE ATT&CK, and incident containment.
Deep networking and security knowledge, including TCP/IP, DNS, firewalls, proxies, VPN, and packet analysis; FortiGate experience is a plus.
Experience analyzing Windows and Linux logs, Active Directory, and Entra ID sign-in logs.
Fluent written and spoken English at a bilingual or near-native level.
Strong interpersonal and communication skills for frequent client interaction through email, calls, and meetings.
Interest in turning recurring manual work into tuned detections and automated playbooks, and in identifying detection gaps and threats that evade the queue.

Nice To Haves

A degree in Cybersecurity, Information Technology, or a related field.
Scripting experience for automation and analysis using Python, PowerShell, or REST APIs.
Experience with Microsoft Sentinel, Defender for Cloud, or Defender for Cloud Apps.
MSSP or multi-tenant SOC experience.
Certifications such as Microsoft SC-200, Fortinet FCP/NSE 5 (FortiSIEM or FortiSOAR), CompTIA CySA+, GCIH, GCIA, or BTL1/BTL2.

Responsibilities

Investigate incidents escalated from L1 by building timelines, determining scope and root cause, and confirming impact.
Correlate endpoint, identity, email, and network telemetry across Microsoft Defender products and FortiGate/FortiSIEM logs.
Conduct proactive threat hunting using Defender XDR advanced hunting (KQL) and FortiSIEM searches, mapped to MITRE ATT&CK.
Lead incident containment and eradication, including device isolation, account disablement, indicator blocking, and malicious email purging, in coordination with IT and network teams.
Write incident reports covering timelines, root causes, actions taken, and recommendations; brief client stakeholders on high-severity events.
Support major incident response and escalate to L3, incident response, or threat intelligence teams when required.
Build, tune, and retire FortiSIEM correlation rules, watchlists, and reports to reduce false positives and address detection gaps.
Design and maintain FortiSOAR playbooks for enrichment, triage, and automated response.
Tune Defender policies, custom detections, suppression rules, and alert thresholds.
Serve as an escalation point and mentor for L1 analysts by reviewing case quality, coaching investigations, and updating runbooks.
Track SOC metrics such as MTTD, MTTR, and false-positive rate, and recommend process improvements.