Soc Analyst - L2

EVOCS•Denver, CO

1d•Onsite

About The Position

As a SOC Analyst L2 at EVOCS, you will own escalated incidents from investigation through containment across FortiSIEM, FortiSOAR, and Microsoft Defender XDR. You will identify root causes, drive incident response, improve detections and automation, and support and mentor L1 analysts. This is a client-facing role involving frequent interaction through email, calls, and meetings. You will investigate and hunt for threats across endpoint, identity, email, and network telemetry; lead containment and eradication; produce incident reports and brief client stakeholders on high-severity events. You will also build and tune SIEM detections and SOAR playbooks, refine Defender policies and alerts, and contribute to SOC metrics and process improvements.

Requirements

3–5 years of hands-on experience as an analyst in a Security Operations Center, including at least 1–2 years at L2 or in incident response; required. IT support or NOC experience alone does not qualify.
Experience with FortiSIEM searches, correlation rules, and parsers; FortiSOAR case handling and playbook building; Microsoft Defender XDR and Defender for Endpoint; KQL advanced hunting; MITRE ATT&CK; and incident containment.
Deep networking and security knowledge, including TCP/IP, DNS, firewalls, proxies, VPN, and packet analysis.
Experience analyzing Windows and Linux logs, Active Directory, and Entra ID sign-in logs.
Fluent English communication skills, written and spoken, at bilingual or near-native level.
Strong interpersonal and communication skills for frequent client interaction via email, calls, and meetings.

Nice To Haves

A degree in Cybersecurity, Information Technology, or a related field.
Scripting for automation and analysis using Python, PowerShell, or REST APIs.
Experience with Microsoft Sentinel, Defender for Cloud, or Defender for Cloud Apps.
MSSP or multi-tenant SOC experience.
Certifications such as Microsoft SC-200, Fortinet FCP/NSE 5 (FortiSIEM or FortiSOAR), CompTIA CySA+, GCIH, GCIA, or BTL1/BTL2.
FortiGate experience.

Responsibilities

Investigate incidents escalated from L1 by building timelines, determining scope and root cause, and confirming impact.
Correlate endpoint, identity, email, and network telemetry across Microsoft Defender products and FortiGate/FortiSIEM logs.
Proactively hunt using Defender XDR advanced hunting with KQL and FortiSIEM searches mapped to MITRE ATT&CK.
Lead incident containment and eradication, including device isolation, account disablement, indicator blocking, and malicious email purging, in coordination with IT and network teams.
Write incident reports documenting timelines, root causes, actions taken, and recommendations; brief client stakeholders on high-severity events.
Support major incident response and escalate to L3, incident response, or threat intelligence teams when required.
Build, tune, and retire FortiSIEM correlation rules, watchlists, and reports to reduce false positives and close detection gaps.
Design and maintain FortiSOAR playbooks for enrichment, triage, and automated response.
Tune Defender policies, custom detections, suppression rules, and alert thresholds.
Serve as an escalation point and mentor for L1 analysts by reviewing case quality, coaching investigations, and updating runbooks.
Track SOC metrics, including MTTD, MTTR, and false-positive rate, and recommend process improvements.