Security Operations Center Analyst Level 2

Role Overview

Join SecurityHQ's 24/7 Security Operations Centre as a Level 2 SOC Analyst, where you'll be instrumental in handling complex security threats for a range of clients. In this position, you will collaborate with Level 1 Analysts, Incident Responders, and Security Engineers to conduct advanced analyses utilizing SIEM, EDR, network, and endpoint technologies. Your goal will be to detect threats, identify root causes, and coordinate containment and resolution efforts.

Work Environment

The role requires working onsite in Dubai and includes rotating shifts (7 AM to 3 PM, 3 PM to 11 PM, 11 PM to 7 AM), with shifts covering weekends and holidays and two days off each week. Assignments will be at one of three customer sites located within 20 kilometers of SecurityHQ’s Dubai office, providing varied daily experiences within a local area.

About SecurityHQ

SecurityHQ is a worldwide leader in cybersecurity solutions focused on enhancing security posture, promoting trust, and maximizing cybersecurity investments for organizations. Operating 24/7 year-round, the company designs, engineers, and manages tailored security solutions aimed at defending today’s digital environments while preparing for future challenges.

Key Responsibilities

• Investigate security incidents escalated from Level 1 SOC Analysts thoroughly.
• Perform detailed analysis across SIEM, EDR, network, endpoint, and cloud-based security technologies.
• Identify attack methods, establish root causes, and evaluate incident scope and impact.
• Analyze malware, phishing attempts, suspicious activities, and complex threat campaigns.
• Lead containment and remediation operations in cooperation with internal teams and customers.
• Create and improve detection rules, SOC playbooks, and monitoring systems.
• Engage proactively in threat hunting and ongoing security enhancements.
• Provide mentorship and technical support to Level 1 SOC Analysts.
• Draft comprehensive incident reports and customer communications.
• Assist in compliance and post-incident reviews.
• Help optimize SIEM and EDR tool management.

Candidate Profile

• 2 to 5 years of experience in SOC, MSSP, or cybersecurity operations.
• Proven skills in incident investigation and response involving SIEM and EDR platforms.
• Strong knowledge of attack frameworks like MITRE ATT&CK and Cyber Kill Chain.
• Experienced in analyzing advanced threats such as malware, phishing, lateral movement, and privilege escalation.
• Good understanding of networking protocols and traffic analysis.
• Skilled in advanced log analysis and cross-tool correlation.
• Familiarity with platforms such as Microsoft Sentinel, QRadar, or Splunk.
• Knowledge of cloud security monitoring for Azure, AWS, or GCP is a plus.
• Ability to manage multiple incident investigations calmly and effectively under pressure.
• Strong teamwork and communication capabilities within a global environment.
• Cybersecurity certifications like GCIH, GCIA, CEH, SC-200, or SIEM-specific credentials preferred.