Security Operations Analyst, Tier 2
Aristocrat
Posted: 10/20/2026AWSAzureCloudCyber SecurityGoogle Cloud PlatformLinuxPython
Risk Management Framework, Cyber Security Ops
Apogee Engineering, LLC
Posted: 10/20/2026Cyber SecurityTypeScript
Security Operations Engineer II
Credit Acceptance
Posted: 10/19/2026CloudCyber Security
Security Operations Analyst II
Rapid7
Posted: 10/19/2026LinuxMacOSSplunk
Security Operations Team Lead
Cyera
Posted: 10/17/2026AWSCloudPython
Lead SOC Engineer
OnTrac
Posted: 10/17/2026AWSCloudCyber SecurityFirewallsGoogle Cloud PlatformPython
Lead SOC Engineer
OnTrac
Posted: 10/17/2026AWSCloudCyber SecurityFirewallsGoogle Cloud PlatformPython
Security Operations Engineer
Collectors
Posted: 10/16/2026AWSAzureCloudEC2Google Cloud PlatformPython
Security Operations, Security Engineering
Rochester Regional Health
Posted: 10/16/2026
SOC Analyst I
AMERICAN SYSTEMS
Posted: 10/16/2026CloudCyber SecurityDNSLinuxSplunkTCP/IPUnix
SOC Analyst II
AMERICAN SYSTEMS
Posted: 10/16/2026CloudCyber SecurityDNSSplunkTCP/IP
Senior Business Analyst – Cyber Operations
EY
Posted: 10/16/2026SDLCSQL
Manager, Security Operations – Incident Response
Davis Polk & Wardwell LLP
Posted: 10/15/2026Cyber Security
Vice President – Infrastructure and Security Operations
CBIZ
Posted: 10/15/2026AWSAzureCloudServiceNow
Global Security Operations Center Operator
Qurate Retail Group
Posted: 10/15/2026Cyber Security
Application Security Operations Specialist
Bank of America
Posted: 10/14/2026CloudPythonServiceNowUnix
Application Security Operations Specialist
Bank of America
Posted: 10/14/2026CloudPythonServiceNowUnix
Vice President – Infrastructure and Security Operations
CBIZ
Posted: 10/14/2026AWSAzureCloudServiceNow
Security Operations Analyst
Thomson Reuters
Posted: 10/14/2026CloudCyber SecurityFirewalls
SoC Engineer
OpenAI
Posted: 10/14/2026Security Operations Analyst, Tier 2
AristocratCore Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in security operations and incident response, with a strong focus on investigation ownership, detection tuning, and cloud security monitoring. Proficient in utilizing SIEM, EDR, and automation tools to enhance threat detection and response capabilities.
Highest-signal resume keywords
SOC Security Operations ExperienceCrowdStrike Query Language ProficiencyHands-On EDR ExperienceCloud Security Monitoring ExperienceIncident Response Process Knowledge
Tech Stack
Tools & technologiesAbout the role
Key responsibilities & impact- Own MSSP customer concerns and medium/high-severity alerts from start to finish
- Scope activity, build timelines, identify indicators of compromise, and investigate endpoint, identity, network, and cloud data
- Review MSSP triage quality and provide tuning, detection-gap, and escalation-criteria feedback
- Triage phishing, malware, and credential-compromise investigations
- Complete containment and remediation using approved playbooks, including host isolation, account disablement, credential reset, and IOC blocking
- Escalate issues to senior specialists with hypotheses, evidence, actions taken, current risk, and specific requests
- Build and run queries across SIEM, EDR, SOAR, and MSSP tooling for investigations and reporting
- Identify detection and tuning gaps; flag false positives and propose tuning, suppression, or enrichment
- Test and validate detection changes shipped by detection engineering
- Document cases to a complete, accurate, and reproducible standard; address QA feedback
- Support specialist-led threat hunts and incident response through root cause analysis
- Improve playbooks, runbooks, and knowledge bases based on casework
- Participate in the 24x7 rotating shift roster, on-call, and occasional weekend coverage
Requirements
What you’ll need- 2+ years of hands-on SOC / security operations experience, with ownership of investigations beyond initial triage
- A bachelor's degree in information systems, cybersecurity, or a related field, or equivalent experience
- Query proficiency on CrowdStrike Query Language (CQL) or transferable SIEM query experience such as KQL or SPL
- Hands-on EDR experience, including live response, process-tree analysis, and host isolation
- Working knowledge of Windows, Linux, and Active Directory (AD) / Entra ID attack patterns
- Comfortable reading authentication, process, and network logs without a playbook
- Solid grasp of the incident-response process, phishing and malware investigations
- Knowledge of MITRE ATT&CK for mapping observed behavior
- Cloud security monitoring experience with AWS, Azure, or GCP
- Scripting experience with Python or PowerShell
- SOAR/automation experience
- Exposure to detection tuning or threat hunting
- Nice to have: Security+, ISC2 SSCP, Microsoft SC-200, CrowdStrike (CCFA/CCFR), Blue Team Level 1/2 (BTL1/BTL2), GCIA, GCIH, or CySA+ certifications
- Participation in a 24x7 rotating shift roster, including on-call and occasional weekend coverage
Benefits
Comp & perks- Annual bonuses and incentives may be available depending on role and location
- Health and wellbeing benefits
- Paid time off
- Retirement plans
- Insurance coverage
- Other local or statutory benefits
- Structured mentoring program
- Hybrid work arrangement
ATS Keywords
✓ Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Incident ResponseDetection TuningPhishing InvestigationsMalware InvestigationsScripting with PythonScripting with PowerShellQuery Proficiency on SIEMProcess-Tree AnalysisHost IsolationRoot Cause Analysis
Soft Skills
Attention to DetailEffective CommunicationProblem-Solving
Tools & Technologies
SIEMEDRSOARAWSAzureGCPActive DirectoryEntra ID
Certifications & Qualifications
Security+ISC2 SSCPMicrosoft SC-200CrowdStrike CCFACrowdStrike CCFRBlue Team Level 1Blue Team Level 2GCIAGCIHCySA+
Industry Keywords
MSSPIndicators of CompromiseDetection-Gap FeedbackTriage QualityThreat HuntingCloud Security MonitoringMITRE ATT&CKCredential ResetAccount Disablement24x7 Rotating Shift