SOC Security Analyst L2

BlueVoyant•Maryland City, MD

2d•Hybrid

About The Position

BlueVoyant is seeking a SOC Security Analyst L2 to defend global customers against evolving adversary activity. The analyst owns and works through a queue of security alerts and tickets, conducting thorough investigations, resolving cases accurately and efficiently, and escalating confirmed or complex incidents to L3 analysts with clear, well-documented findings. The role works closely with senior analysts and clients to reduce the impact and dwell time of security incidents. It reports into BlueVoyant SOC leadership and operates under BlueVoyant processes, tooling, and supervision, including when working in client environments. The role is hybrid in Maryland and requires four 10-hour shifts, scheduled Wednesday through Saturday or Sunday through Tuesday; exact shift timings are to be determined. U.S. citizenship is required for work on certain federal contracts, and the posting states that successful completion of a background check and any client-required security vetting is required.

Requirements

Ability to manage a high-volume ticket queue in a fast-paced environment while maintaining accuracy and attention to detail.
Strong written and verbal communication skills, including the ability to document findings clearly and explain technical issues in accessible language.
Strong teamwork and interpersonal skills, including effectiveness in a globally distributed team.
Ability to work directly with clients to provide updates and gather information.
Knowledge and experience with SIEM solutions, Cloud App Security tools, and EDR.
Experience analyzing endpoint, web, email, and authentication logs.
Solid understanding of network protocols and network telemetry.
Knowledge of common attack techniques, including phishing, business email compromise, credential harvesting, LOLBin use, and lateral movement.
Working knowledge of SIEM workflows, preferably Microsoft Sentinel and Splunk.
Working knowledge of Microsoft 365 and Entra ID security alerts and sign-in logs.
Working knowledge of email security and phishing analysis.
Working knowledge of network monitoring metadata, including web logs, firewall logs, and WAF/IDS.
Working knowledge of Windows and Unix operating system fundamentals and common forensic artifacts.
Working knowledge of ticketing and case management systems.
Ability to successfully complete a background check and any client-required security vetting.
Bachelor's degree in Information Security, Computer Science, or another IT-related field, or equivalent professional experience.
U.S. citizenship is required for employees performing work on certain federal contracts.

Nice To Haves

3+ years of hands-on SOC/TOC/NOC experience.
Experience in an MSSP/MSP environment supporting multiple clients.
Basic malware analysis or sandboxing experience.
Experience writing SIEM queries in KQL or SPL.
Familiarity with Microsoft Sentinel, Splunk, Microsoft Defender suite, CrowdStrike Falcon, and SentinelOne.
Understanding of a scripting language such as Python or PowerShell.
Relevant certifications such as Security+, CySA+, Network+, GIAC (e.g. GSEC, GCIH), Microsoft SC-200, or CEH.

Responsibilities

Monitor, triage, and investigate security alerts and tickets from multiple sources, including SIEM logs, endpoint logs, and EDR telemetry.
Own assigned tickets through resolution, working within defined SLAs and prioritizing by severity and client impact.
Research indicators and activity to determine reputation and suspicious attributes.
Analyze suspicious files, emails, URLs, and attacker infrastructure to support investigations.
Determine whether activity is malicious, benign, or a false positive, and escalate confirmed or complex incidents to L3 analysts with supporting evidence.
Accurately document investigation steps, findings, and recommended actions in ticketing and case management systems.
Take initial response actions according to runbooks and client-approved procedures, such as isolating endpoints or disabling compromised accounts.
Communicate with clients to provide ticket updates, request information, and share remediation guidance.
Identify false-positive or benign detections and recommend tuning improvements.
Contribute to improving runbooks, procedures, and automation.
Support and share knowledge with L1 analysts and incorporate feedback from L3 peer review and QA.
Work across BlueVoyant-managed systems and client-provided environments in accordance with approved access controls, logging, operating procedures, and security policies.