Role Summary

The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity.

Key Responsibilities

• Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning
• Lead incident response: containment, eradication, recovery and root cause analysis
• Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats
• Tune SIEM correlation rules and use cases to reduce false positives
• Run threat hunting based on threat intelligence and MITRE ATT&CK
• Create and maintain incident response playbooks and SOAR workflows
• Supervise and mentor L1 analysts, review their work, and manage shift handovers
• Write incident reports and present findings to technical and management stakeholders
• Report incidents in line with NCA requirements and SMC's escalation matrix
• Track SOC KPIs such as MTTD, MTTR and SLA compliance.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, IT or related field
• 4–6 years in a SOC, with at least 2 years at L2 level
• Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar)
• Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms
• Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols
• Experience in an enterprise or managed SOC (MSSP) environment
• Saudi national, fluent in Arabic and English
• Willing to support on-call or shift rotation if required

Preferred Certifications

GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification