Security Operations Center (SOC) Tier II Analyst

Description

Position Summary 

The SOC Tier II Analyst serves as the technical lead within NTG’s 24x7x365, Security Operations Center, providing advanced threat detection, incident response, and technical escalation support. This individual collaborates with Tier I analysts, engineers, and client stakeholders to ensure the continuous protection, monitoring, and improvement of enterprise environments. The Tier II Analyst functions as an experienced hands-on technical professional and mentor, responsible for guiding daily SOC operations, tuning security tools, and leading client-facing discussions on security posture and incident response.

 

Essential Duties and Responsibilities

Threat Detection, Analysis, and Response

• Perform advanced threat analysis to identify, assess, and mitigate cybersecurity incidents, vulnerabilities, and insider threats.
• Lead investigations using SIEM platforms—Splunk , Fortinet, and Microsoft Sentinel, to detect anomalous or malicious activity.
• Execute comprehensive incident response processes, including triage, containment, eradication, and recovery actions.
• Conduct forensic analysis and log correlation to determine root causes and attack vectors.

SOC Operations and Tool Optimization

• Operate and optimize SOC tools, including SIEM (Splunk), IDS/IPS, EDR, and network security appliances.
• Collaborate with the client Splunk Engineers to refine correlation searches, alerts, and dashboards for improved accuracy and signal-to-noise ratio.
• Participate in regular “scan” meetings for change management and Splunk tuning review.
• Develop and implement tuning recommendations, automation scripts, and detection improvements.

Leadership and Mentorship

• Act as the technical lead in the room, providing escalation support and guidance to Tier I analysts.
• Mentor and coach junior analysts on threat-hunting techniques, SOC procedures, and best practices.
• Organize and follow up on assigned tasks, tickets, and ongoing investigations.
• Lead and document after-action reviews (AARs) following major incidents.

Client and Stakeholder Communication

• Represent NTG during weekly client meetings, present technical updates in non-technical language.
• Collaborate closely with the SOC Manager and customer counterparts to maintain situational awareness and ensure      transparent communication.
• Deliver concise, actionable reporting on ongoing incidents, emerging threats, and mitigation progress.

Process Improvement and Documentation

• Assist in developing, maintaining, and improving SOC playbooks, runbooks, and SOPs.
• Capture lessons learned and integrate them into process improvements.
• Contribute to strategic detection engineering and threat-hunting initiatives.

Requirements

Minimum Qualifications (Knowledge, Skills, and Abilities)

• Minimum of 4–5 years of experience in cybersecurity or SOC operations, including Tier I/II support.
• Proficiency with Splunk (searches, dashboards, correlation rules, tuning, and administration).
• Strong understanding of cybersecurity concepts, attack vectors, and the MITRE ATT&CK framework.
• Hands-on experience with EDR, IDS/IPS, firewalls, and forensic tools.
• Familiarity with NIST and ISO 27001 security frameworks
• Excellent written and verbal communication; able to convey complex security issues clearly to non-technical audiences.
• Strong client-facing demeanor and composure under pressure.
• Team-oriented with leadership qualities and a proactive, mentoring mindset.

PREFERRED QUALIFICATIONS

• Bachelor’s degree in Cybersecurity, Computer Science, or related discipline 
• Basic scripting or automation skills (Python, PowerShell).
• CISSP, CEH, or GIAC certifications such as GCIH, GCIA, or GCFA.
• Splunk Certified Power User / Administrator strongly preferred.
• Security+ CE (minimum baseline for DoD 8570/8140 compliance).

Physical Demands and Work Environment 

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this position. Reasonable accommodations may be made to enable individuals with disabilities to perform these functions.

While performing the duties of this position, the employee is regularly required to talk or hear. The employee frequently is required to use hands or fingers, handle or feel objects, tools, or controls. The employee is occ