> Markdown version of [/jobs/ext/2018071-security-operations-center-tier-2-analyst](https://www.wearedevelopers.com/jobs/ext/2018071-security-operations-center-tier-2-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Operations Center - Tier 2 Analyst - **Company:** Vanderlande Industries - **Location:** Veghel, Netherlands (Remote available) - **Experience:** Experienced - **Salary:** €4,347.0 - €5,900.0 - **Contract:** Permanent contract - **Skills:** Data Analysis, CompTIA Security+, Cyber Security, Identity and Access Management, Information Technology Operations, Intrusion Detection Systems, Python (Programming Language), Network Security, Log Analysis, Windows PowerShell, Security Information and Event Management, Software Vulnerability Management, Forensic Toolkit, Mitre Att&ck, Cyber Threat Analysis, Patch Management, Workday, User Accounts - **Published:** August 11, 2026 - **Apply:** https://vanderlande.wd3.myworkdayjobs.com/careers/job/Veghel/Security-Operations-Center---Tier-2-Analyst_JR36624-1?shared_id=Career_Website ## About the Role * 3+ years of experience in cybersecurity, with at least 2 years in a SOC or IR role. * Advanced expertise in SIEM, EDR, and forensic tools. * Strong understanding of MITRE ATT&CK framework and threat actor TTPs. * Experience with scripting and automation (e.g., Python, PowerShell). * Ability to lead and manage incident response efforts under pressure. * Relevant security certifications from ISC2 or ISACA * Excellent communication and leadership skills. Qualifications * Bachelor's degree in IT, Cybersecurity, or CS * Certifications such as: * CompTIA Security+ * Microsoft SC-200 * CEH, CySA+ * GIAC certifications (GSEC, GCIH, GMON) * Experience with: * EDR, IDS/IPS, and network security tools * SIEM/SOAR workflows/playbooks * Threat intelligence platforms Desired competencies * Strong analytical and problem-solving skills * Attention to detail * Ability to work under pressure during incidents * Team-first mindset and willingness to learn * Ability to recognize patterns and anomalies * Prior SOC or IR experience * Strong analysis and investigation skills * Familiarity with threat intelligence and adversary behavior * Ability to perform forensic/log analysis * More advanced certifications preferred Important: * 24/7 SOC environment (shift work may be required) * Fast-paced operational setting with tight response timelines * Collaboration with cross-functional IT and security teams ## Description As the Security Operations Center - Tier 2 Analyst will lead complex investigations, coordinate incident response efforts, and drive continuous improvement in threat detection and response capabilities. You will serve as a technical expert and escalation point for Tier 1 analysts, customers or other departments. This role supports incident detection, escalation, and response activities within customer environments, in line with agreed SOC service scope and service level agreements (SLAs). You will have had previous experience in handling escalation from Tier 1 and direct work in security monitoring, threat intelligence, or incident response What will you be doing? * Perform advanced analysis of escalated security incidents and support investigation efforts. * Act as an escalation point for Tier 1 analysts and provide expert guidance during incident response activities. * Develop and tune detection rules and use cases in SIEM and other platforms. * Perform threat hunting based on intelligence and behavioral analysis. * Conduct forensic analysis and reverse engineering of malware when needed. * Collaborate with threat intelligence teams to enrich investigations. * Provide strategic recommendations to improve SOC processes and technologies. * Mentor junior analysts and contribute to training programs. * Participate in detection validation and lessons-learned activities to enhance SOC detection and response. A day in this role: Monitoring & Detection * Validate complex alerts escalated by Tier 1 * Determine scope, impact, and severity of confirmed incidents. * Perform deep log analysis, forensic investigations, and develop custom detection rules. * Implement containment, mitigation and remediation actions.in accordance with playbooks and customer agreements * Understanding TTPs (tactics, techniques, procedures) of threat actors * Ability to develop custom detection rules and correlation logic Investigation & Analysis * Analyze data patterns and outliers to identify threat actor behaviors and insider threats. * Conduct deep investigations into logs, network telemetry, and endpoint activity. * Document findings, actions taken, and recommended next steps. Incident Response Support * Assist the SOC team during active security incidents by collecting evidence and containing low-severity threats as per playbooks. * Follow established runbooks to ensure consistent and compliant response actions. * Respond to escalated security incidents requiring advanced analysis. * Provide containment recommendations and support remediation. Access Management * Processing user access requests (add, remove, modify) following established workflows. * Enforcing least-privilege principles and role-based access standards. * Conducting periodic access reviews (user accounts, permissions, group memberships). * Investigating and escalating suspicious access activities or unauthorized access attempts. Patch Management * Assist with tracking and verifying system patch status as part of vulnerability review activities. * Monitor patch-related alerts (failed deployments, outdated versions) within security tools and coordinate remediation with IT operations. * Support the vulnerability management process by validating missing patches identified during scans and escalating high-risk findings. (This is aligned with Tier 1's documented tasks involving vulnerability scans and reporting.) Reporting & Communication * Generate clear, accurate incident reports and daily shift summaries. * Communicate event details with internal teams in a professional and timely manner. Continuous Improvement * Recommend improvements to detection rules, response processes, and SOC procedures. * Stay current on cyber threat trends, attacker techniques (TTPs), and security best practices. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Destigmatizing the Workplace: Building Real Inclusion](https://www.wearedevelopers.com/videos/1492-destigmatizing-the-workplace-building-real-inclusion) - [Progressive Delivery in Kubernetes](https://www.wearedevelopers.com/videos/949-progressive-delivery-in-kubernetes) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [The Future of Employee Wellbeing: Benefits, Trust & Performance](https://www.wearedevelopers.com/videos/1808-the-future-of-employee-wellbeing-benefits-trust-performance) - [Leveraging Large Language Models for Legacy Code Translation: Challenges and Solutions](https://www.wearedevelopers.com/videos/1157-leveraging-large-language-models-for-legacy-code-translation-challenges-and-solutions) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Best Companies in the Netherlands: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/193-best-companies-in-the-netherlands-top-25-companies-in-2023) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)