> Markdown version of [/jobs/ext/4604695-soc-security-analyst-l2](https://www.wearedevelopers.com/jobs/ext/4604695-soc-security-analyst-l2). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SOC Security Analyst L2

- **Company:** BlueVoyant
- **Location:** United States (Remote available)
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Microsoft Antivirus, Unix, Cloud Computing, Cyber Security, Identity and Access Management, Intrusion Detection Systems, Python (Programming Language), Log Analysis, Network Monitoring, Network Protocols, Windows PowerShell, Anti-Phishing, Kusto Query Language, Security Information and Event Management, Data Logging, Scripting, Malware, Firewalls (Computer Science), Information Technology, Microsoft Sentinel, Splunk, SentinelOne Expertise
- **Published:** November 6, 2026
- **Apply:** http://bluevoyant.applytojob.com/apply/jobs/details/Wp8PlLKV7n

## About the Role

* Ability to manage a high-volume ticket queue in a fast-paced environment while maintaining accuracy and attention to detail.
 * Strong written and verbal communication skills, with the ability to document findings clearly and explain technical issues in easy-to-understand language.
 * Strong teamwork and interpersonal skills, including working effectively within a globally distributed team.
 * Ability to work directly with clients to provide updates and gather information.
 * Knowledge and experience with SIEM solutions, Cloud App Security tools, and EDR.
 * Experience in endpoint, web, email, and authentication log analysis.
 * Solid understanding of network protocols and network telemetry.
 * Knowledge of common attack techniques, including phishing, business email compromise (BEC), credential harvesting, LOLBin use, and lateral movement.
 * Working knowledge of:
 + SIEM workflows (preferably Microsoft Sentinel and Splunk)
 + Microsoft 365 and Entra ID security alerts and sign-in logs
 + Email security and phishing analysis
 + Network monitoring metadata (web logs, firewall logs, WAF/IDS)
 + Windows and Unix operating system fundamentals and common forensic artifacts
 + Ticketing and case management systems
 * Ability to successfully complete a background check and any client-required security vetting.

Nice to Have:

 * 3+ years of hands-on SOC/TOC/NOC experience.
 * Experience in an MSSP/MSP environment supporting multiple clients.
 * Basic malware analysis or sandboxing experience.
 * Experience writing SIEM queries (KQL or SPL).
 * Familiarity with Microsoft Sentinel, Splunk, Microsoft Defender suite, CrowdStrike Falcon, and SentinelOne.
 * Understanding of a scripting language such as Python or PowerShell.
 * Relevant certifications such as: Security+, CySA+, Network+, GIAC (e.g. GSEC, GCIH), Microsoft SC-200, CEH

Education:

 * Bachelor's degree in Information Security, Computer Science, or another IT-related field, or equivalent professional experience., This role works 4x 10 Hour Shifts. Wednesday - Saturday or Sunday - Tuesday. Are you able to commit to this schedule with 50 % of day shifts being worked onsite in our College Park office? Any night shifts will be 100% remote.*
Do you have hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, or similar enterprise SIEM tools?*
Do you have experience investigating and resolving security alerts and tickets from sources such as EDR, SIEM, email, and authentication logs?*
Do you have experience analyzing security alerts and logs from multiple sources such as EDR, SIEM, network telemetry, and authentication systems?*
Do you have experience managing a ticket queue within a ticketing or case management system, working to SLAs?*
Do you have experience escalating confirmed or complex security incidents to senior analysts with documented findings?*
Do you have experience communicating with clients, ideally within an MSSP or MSP environment?*
Are you willing to complete a background check and any client-required security vetting?*
Are you able to communicate fluently in English, both written and verbal, in a professional environment?*

## Description

BlueVoyant is seeking a SOC Security Analyst L2 to join our Security Operations Center, defending our global customers against constant and evolving adversary activity. In this role you will own and work through a queue of security alerts and tickets, carrying out thorough investigations, resolving cases accurately and efficiently, and escalating confirmed or complex incidents to L3 analysts with clear, well-documented findings. You will work closely with senior analysts and clients to reduce the impact and dwell time of security incidents. This role reports into BlueVoyant SOC leadership and operates under BlueVoyant processes, tooling, and supervision at all times, including when working within client environments.

What You'll Do:

 * Monitor, triage, and investigate security alerts and tickets from multiple sources, including SIEM logs, endpoint logs, and EDR telemetry.
 * Own assigned tickets through to resolution, working within defined SLAs and prioritizing by severity and client impact.
 * Research indicators and activities to determine reputation and suspicious attributes.
 * Perform analysis of suspicious files, emails, URLs, and attacker infrastructure to support investigations.
 * Determine whether activity is malicious, benign, or a false positive, and escalate confirmed or complex incidents to L3 analysts with clear supporting evidence.
 * Document investigation steps, findings, and recommended actions accurately within the ticketing and case management system.
 * Take initial response actions in line with runbooks and client-approved procedures, such as isolating endpoints or disabling compromised accounts.
 * Communicate with clients to provide ticket updates, request information, and share remediation guidance.
 * Identify false-positive or benign detections and recommend tuning improvements.
 * Contribute to the improvement of runbooks, procedures, and automation.
 * Support and share knowledge with L1 analysts and incorporate feedback from L3 peer review and QA.
 * Operate across BlueVoyant-managed systems and client-provided environments in accordance with client-approved access controls, logging, and BlueVoyant operating procedures, maintaining strict separation and adherence to security policies.