Security Operations
SOC Analyst (Tier 2)
Investigate escalated security alerts, contain threats and improve detections for clients monitored by our 24/7 security operations center.
- San Jose, CA (hybrid)
- Full time
- Posted October 12, 2026
What you will do
- Investigate and validate escalated alerts across endpoint, identity, email and cloud telemetry
- Execute agreed containment actions and coordinate with client contacts during incidents
- Write clear incident timelines and root-cause summaries for client leadership
- Tune detection rules and propose new content based on observed techniques
- Mentor Tier 1 analysts and contribute to playbook improvements
- Participate in a rotating shift and on-call schedule
What you bring
- 3+ years in a SOC, incident response or security engineering role
- Hands-on experience with an EDR platform and a SIEM
- Working knowledge of MITRE ATT&CK, Windows and Linux internals, and network protocols
- Strong written communication under time pressure
- Relevant certification such as Security+, GCIH, GCIA or equivalent experience
Nice to have
- Experience with Microsoft Defender, CrowdStrike or Splunk
- Scripting in Python or PowerShell for automation
- Cloud security experience on Azure or AWS