SOC Analyst Tier 2

We’re looking for a SOC Analyst Tier 2 to serve as the primary investigation tier in the operations center. Tier 2 analysts receive escalations from Tier 1, conduct in-depth log correlation and threat analysis, perform PCAP review, and determine whether an incident requires Tier 3 or incident response escalation., * Monitor SIEM dashboards and security tooling alerts

• Serve as the advanced triage for all incoming customer calls, alerts, emails, and tickets using established playbooks to categorize, prioritize, and route
• Create and manage detailed tickets for all confirmed or suspected events
• Receive, review, and investigate all Tier 1 escalations within SLA
• Perform deep log correlation across multiple data sources such as endpoint, network, application, identity
• Conduct PCAP analysis for network-based threat investigation
• Conduct root cause analysis or determine scope of compromise and identify affected systems, lateral movement, data exfiltration indicators
• Escalate confirmed incidents to Tier 3/IR with a complete documentation and investigation summary
• Tune false positive alerts Tier 3 and Tier 4 engineers to reduce
• Write clear and thorough investigation reports for all escalated incidents
• Mentor T1 analysts such as reviewing their triage decisions and provide coaching through their analysis
• Maintain and update playbooks based on new TTPs and lessons learned
• Maintain the SOC Event log for all events during the shift
• Maintain situational awareness of the threat landscape and active campaigns
• Participate briefings and training sessions

• 3+ years of SOC analyst experience with hands-on investigation or threat hunting experience
• Bachelor’s degree in Cyber Security, Information Technology, Computer Science, Information Security, or related field. In lieu of degree, four additional years of experience in a NOC, SOC, IT security, or network engineering role
• One of the following certifications, equivalent or better: Sec+, CYSA+, GCIH, SecX, CEH, GCIA, GSOC, CISSP
• Experience with SIEM platforms and log analysis
• Experience with SIEM query languages - SPL, KQL, or equivalent
• Experience with PCAP analysis tools (Wireshark, NetworkMiner, or equivalent)
• Strong understanding of attacker TTPs and MITRE ATT&CK framework
• Ability to work shifts including nights, weekends, and holidays on rotating shift schedule, * Active Secret clearance preferred but not required
• Experience with EDR platforms (CrowdStrike Falcon, SentinelOne, or equivalent)
• Memory forensics or malware triage experience

• Salary: $90k- $140k
• 100% employer-paid medical, dental, and vision premiums for employees and dependents
• Flexible Spending Accounts (healthcare, dependent care, and commuter)
• Life insurance, short-term disability and long-term disability
• 401(k) with immediate vesting of company contribution
• Generous PTO policy (15 vacation, 5 sick, 2 personal days, 11 holidays)
• We support your growth through certification reimbursement, dedicated professional development funding, and company-provided access to online learning platforms, $90k- $140k

With more than 20 years of securing some of the U.S. Department of Defense and the Intelligence Community’s most critical networks, JFL Consulting, LLC provides advanced network security solutions to a range of US Government and US commercial clients.

Our cybersecurity operators are experts at assessing and defending mission-critical data and the networks that facilitate their operation. We are focused on delivering advanced products and industry best practices that meet each customer’s unique requirements. Visit www.jflconsulting.com