[Hiring] SOC Analyst @Arancia

Role Description

We are seeking a skilled and highly motivated SOC Analyst – Level 2 to join our Security Operations team. This role is ideal for someone with hands-on experience in SOC operations, threat investigation, and incident response.

• Take ownership of advanced triage and investigation of alerts escalated from L1.
• Execute containment actions across customer environments.
• Drive detection quality through structured tuning and feedback loops.
• Work closely with L1 analysts, Detection Engineering, Incident Response, and Threat Intelligence teams.
• Transition into proactive threat hunting during evening shifts.
• Direct progression pathway into L3, Threat Hunting, Detection Engineering, or Incident Response.

Key Responsibilities

• Alert Triage & Investigation:
  • Perform advanced triage of alerts escalated from L1.
  • Investigate security events across endpoint, identity, network, and cloud telemetry.
  • Correlate events and map adversary behavior to MITRE ATT&CK.
  • Enrich findings with relevant threat intelligence context.
• Incident Response Execution:
  • Execute or coordinate containment actions including host isolation, account disablement, and blocking indicators.
  • Partner with Incident Response teams on high-severity or multi-system incidents.
  • Document actions, timelines, and evidence with a clear chain of reasoning.
• Threat Hunting:
  • Conduct hypothesis-driven threat hunting across datasets.
  • Convert hunt findings into new detections or tuning recommendations.
  • Maintain proper documentation of hunts and derived detections.
• Detection Quality & Tuning:
  • Provide structured feedback to Detection Engineering on false positives and tuning opportunities.
  • Validate new detection rules before production rollout.
  • Contribute to playbook authoring and continuous improvement.
• Case Management & Reporting:
  • Produce clear, complete incident reports for stakeholders.
  • Track and support SLA metrics including MTTD, MTTR, and MTTC.
  • Participate in structured shift handovers and post-incident reviews.
• Collaboration & Cross-Functional Teamwork:
  • Collaborate closely with internal teams.
  • Mentor L1 analysts on triage quality and investigation techniques.
  • Contribute to internal knowledge bases and lessons-learned sessions.

Qualifications

• 2–5 years of experience in a SOC, Incident Response, or equivalent hands-on blue team role.
• Strong understanding of cybersecurity concepts including endpoint, network, identity, and cloud security.
• Solid grounding in MITRE ATT&CK and its operational application in investigations.
• Hands-on experience with at least one modern SIEM and one EDR solution.
• Working knowledge of identity and cloud telemetry.
• Proficiency in KQL; additional query languages are a plus.
• Basic scripting in Python or PowerShell for automation and enrichment.
• Strong investigative mindset and clear written communication.
• Ability to remain calm under pressure and a willingness to mentor.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• Certifications such as BTL1, CySA+, GCIH, Microsoft SC-200, or CompTIA Security+ are considered a plus.

Requirements

• Exposure to SOAR platforms, threat intelligence platforms, malware analysis tools, and network detection tools.
• Cloud security experience across Azure, AWS, or GCP.

Benefits

• Modern SOC stack and tooling.
• Agentic SOC platform enabling AI-assisted triage and investigations.
• Clear career progression into L3, Threat Hunting, Detection Engineering, or IR.
• Structured onboarding and continuous learning support.
• Investigation-led culture focused on quality over ticket volume.

Shift Details

• This role operates on a 24/7 rotating schedule including day, evening, and night shifts.
• Evening shifts follow a hybrid structure combining live queue work with scheduled threat hunting blocks.
• Structured handovers are conducted at every shift change.
• Shift allowances apply for evenings, nights, weekends, and public holidays.

Onboarding (First 30 Days)

• Days 1–15 — Shadowing: Pair with senior analysts to observe live investigations.
• Days 16–30 — Supervised Queue: Take ownership of alerts under direct supervision.
• Day 30+ — Full Ownership: Independently manage the queue and rotate into threat hunting responsibilities.

What a Typical Shift Looks Like

• Start by reviewing handover notes, open incidents, and ongoing hunts.
• Work through the escalation queue by triaging, investigating, containing, and documenting incidents.
• During evening shifts, execute scheduled hunts or deep-dive into complex investigations.
• End the shift by updating case notes and preparing a clear handover.

Hours

• 40 hours per week (shift-based schedule).

Compensation

• Market competitive salary based on experience & qualifications.