VP Security Operations Center (SOC) Cyber Fraud Analyst – Level 2 (L2)
About The Position
The SOC Analyst (L2) performs continuous monitoring, initial triage, and in-depth analysis of security events across endpoint, network, email, big data, and web telemetry and behavior anomaly detection tools. The role provides high-quality documentation and escalation to Incident Response, and performs Level 2 peer review of L1 analysis to ensure accuracy, thoroughness, and adherence to established procedures. The L2 analyst leads education and training for L1 analysts as a formal mentor and technical lead. The role identifies and triages service outages and log discrepancies, proactively addressing potential data visibility issues. It also designs and implements security use cases, conducts content reviews, drafts Business Requirements Documents (BRDs), and monitors use case performance for over-alerting or underperformance. The analyst leads and organizes cross-organizational communications, serving as a liaison between the SOC and other business units. The role supports execution of Information Security directives and activities in alignment with enterprise data security policy, while driving strategic improvements, automation enablement, and mentorship within the SOC team. The position includes hands-on 24x7 monitoring and response to cyber-fraud incidents.
Requirements
- Advanced knowledge of cyber-enabled fraud TTPs, including account takeover, payment fraud, identity theft, and social engineering schemes.
- Extensive hands-on experience investigating and managing complex fraud incidents within an enterprise SOC environment.
- Deep expertise with data analytics and query languages or tools such as SQL, Python, SAS, or R for interrogating large datasets.
- Strong understanding of web application defense, including HTTP/S, DNS, and network traffic analysis in multi-layer enterprise systems.
- Experience with big data technologies such as Hadoop and Spark, RDBMS, ETL tools, data warehouses, and business intelligence platforms.
- Understanding of application security standards, including OWASP Top 10 and API security, and risk assessment procedures.
- Proficiency correlating network, endpoint, and WAF security logs with application and transactional logs to analyze fraud events.
- Demonstrated ability to lead fraud incident response, document complex analytical findings, and mentor junior analysts.
- Typically, 6–10 years of experience in cyber-fraud analysis, incident response, or data analytics within a security context.
- Ability to work in a 24x7 shift environment.
- Bachelor’s degree or university degree in Data Science, Computer Science, Information Systems, or a related field, or equivalent experience.
Nice To Haves
- Experience with Web Application Firewalls (WAF) and Bot Defense solutions.
- Professional certifications such as Certified Fraud Examiner (CFE), GIAC Certified Incident Handler (GCIH), or certifications in data analytics or machine learning.
- Experience with data visualization tools such as Tableau or Power BI for creating fraud trend dashboards and reports.
- Experience developing or tuning rules and models for fraud detection systems.
- Experience with scripting and automation, such as Python or PowerShell, to automate response tasks.
Responsibilities
- Perform hands-on 24x7 monitoring and triage of alerts from SIEM, EDR, IDS/IPS, and enterprise fraud tools, serving as an active analyst and escalation point for complex incidents.
- Perform Level 2 peer review of L1 analysis, ensuring accuracy, thoroughness, and adherence to investigative procedures; re-analyze alerts when necessary.
- Execute and coordinate rapid response and containment for active fraud incidents, including locking compromised accounts, blocking fraudulent transactions, and mitigating attacker access at application and network layers.
- Document response actions, analytical findings, and decisions in the case management system to create comprehensive records for escalation, reporting, and future analysis.
- Design, author, and implement advanced SOC playbooks and standard operating procedures for complex cyber-fraud incident scenarios.
- Lead identification and implementation of AI/LLM use cases for advanced analysis, threat hunting, and incident response.
- Support and enhance SOC governance, including documentation standards, escalation paths, and operational readiness.
- Lead education and training efforts for L1 analysts and foster continuous improvement and operational excellence.
- Serve as a formal mentor and technical lead, providing hands-on guidance on cyber-fraud analysis, data interrogation, and incident triage.
- Conduct ongoing trend analysis and identify recurring threat and cyber-fraud patterns.
- Identify potential malware-related activity through alert, log, telemetry, and artifact review, and escalate suspected malicious artifacts according to established procedures.
- Identify, design, and implement security use cases; conduct content reviews, draft BRDs, and monitor performance for over-alerting or underperformance.
- Identify and triage service outages and log discrepancies, addressing potential data visibility issues.
- Attend, lead, and organize cross-organizational communications and conference calls, acting as a liaison between the SOC and other business units.
Benefits
- Medical coverage
- Dental coverage
- Vision coverage
- 401(k)
- Life insurance
- Accident insurance
- Disability insurance
- Wellness programs
- Paid time off, including vacation and sick leave
- Paid holidays
- Discretionary and formulaic incentive and retention awards for eligible employees
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
