L2 Security Operations Engineer Crowstrike

Rapid7 Falcon Tooling Parsing Coaching Phishing Timelines Operations Automation ServiceNow IdentityIQ Peer Review Investigation Microsoft 365 Cloud Security Azure Sentinel Medical Records Authentications Active Directory Data Engineering Windows Defender Incident Response Windows PowerShell Business Valuation Financial Services Workflow Management Process Improvement Evidence Preservation Full Stack Development Large Language Modeling Business Transformation Stakeholder Coordination Cyber Threat Intelligence Multi-Factor Authentication Software As A Service (SaaS) Business Continuity Planning Microsoft Defender Antivirus Python (Programming Language) Endpoint Detection And Response Troubleshooting (Problem Solving) Application Programming Interface (API) Security Information And Event Management (SIEM), Security Monitoring & Investigation

Serve as the L2 escalation point for alerts across endpoint, identity, cloud, network, email, and application sources.

Correlate logs and evidence across multiple tools to determine scope, severity, and likely impact.

Independently investigate complex or escalated events using hypothesis-driven analysis; rapidly identify root cause, attack path, scope, severity, and business impact.

Escalate high-impact or unresolved activity with clear evidence and recommendations, and maintain complete, defensible case notes, timelines, and incident records.

Incident Response

Lead technical response for assigned incidents, including scoping, containment, remediation, recovery validation, evidence preservation, and stakeholder coordination.

Investigate phishing, credential compromise, malware, account takeover, privileged-access, and insider-risk scenarios, applying sound judgment when conditions fall outside established playbooks.

Identify affected users, systems, identities, applications, and data sources, and contribute root-cause findings and lessons learned to post-incident reviews.

Identity, Email, Endpoint & Cloud Security

Analyze suspicious authentication, Microsoft Entra ID, Active Directory, multi-factor authentication, and privileged-account activity.

Investigate user-reported phishing and coordinate remediation and follow-up.

Analyze CrowdStrike Falcon endpoint detection and response alerts and security events across Microsoft 365, cloud, and SaaS platforms; support evaluation and adoption of Microsoft security tooling as the platform strategy evolves.

SIEM Data Engineering & Detection Enhancement

Engineer, onboard, and maintain security data feeds to the SIEM, including log source configuration, parsing, normalization, field mapping, and timestamp integrity.

Monitor data-source health and troubleshoot ingestion gaps, delays, and quality issues before they affect detection coverage.

Translate investigation findings, threat intelligence, and MITRE ATT&CK coverage analysis into tested detection and alerting improvements.

Tune detections to reduce false positives and improve alert fidelity; submit all detection changes for peer review before deployment.

SOAR & Automation

Design, tune, test, and maintain SOAR playbooks and integrations that enrich alerts, automate repeatable investigation steps, and accelerate response.

Improve SOAR accuracy and efficiency by measuring playbook outcomes, eliminating failure points, and preserving appropriate validation, auditability, and analyst control.

Develop PowerShell, Python, or API-based automation that reduces manual effort and expedites troubleshooting; all automation changes are peer reviewed.

Use approved AI-assisted tools to enrich investigations, summarize evidence, and improve analyst efficiency.

L1 Support & Process Improvement

Provide occasional coaching and guidance to L1 analysts through case reviews, escalation feedback, and knowledge sharing.

Improve runbooks, knowledge articles, escalation criteria, and SOC workflows based on operational metrics and lessons learned.

Participate in on-call rotation as needed, outside of standard business hours.

Preferred Qualifications

5+ years of Cyber/SOC experience, including incident response or detection engineering.

Hands-on experience with CrowdStrike Falcon, including Falcon Insight, Next-Gen SIEM, and Falcon Fusion SOAR.

Experience with Microsoft Sentinel and Microsoft Defender XDR, or with migrating between security platforms.

Exposure to Splunk, Proofpoint, SailPoint, Palo Alto Networks, Rapid7, or ServiceNow Security Operations.

Experience in financial services or another regulated industry.

Experience using approved large language model or AI-assisted tools for investigation, analysis, documentation, or automation., Crowdstrike, Microsoft Defender, Security, Security operations, SIEM, SOAR, Palo Alto, Splunk, Entra ID, Incident response, telemetry, thresholds, Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.

We’re partners in transformation. We help clients activate ideas and solutions to take advantage of a new world of opportunity. We are a team of 80,000 strong, working with over 6,000 clients, including 80% of the Fortune 500, across North America, Europe and Asia. As an industry leader in Full-Stack Technology Services, Talent Services, and real-world application, we work with progressive leaders to drive change. That’s the power of true partnership. TEKsystems is an Allegis Group company., Were a leading provider of business and technology services. We accelerate business transformation for our customers. Our expertise in strategy, design, execution and operations unlocks business value through a range of solutions. Were a team of 80,000 strong, working with over 6,000 customers, including 80% of the Fortune 500 across North America, Europe and Asia, who partner with us for our scale, full-stack capabilities and speed. Were strategic thinkers, hands-on collaborators, helping customers capitalize on change and master the momentum of technology. Were building tomorrow by delivering business outcomes and making positive impacts in our global communities. TEKsystems and TEKsystems Global Services are Allegis Group companies. Learn more at TEKsystems.com.