SOC Security Analyst – Level 2, Investigation and Response

Job not on LinkedIn

🕒 March 12

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

IPV7

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2014

🔒 Cybersecurity

Cybersecurity • Cloud Computing • Consulting

IPV7 is a business solution partner that specializes in engineering services, consulting, cyber security, network management, and cloud computing. The company provides tailored solutions for Internet Service Providers (ISPs), telecommunication companies, government, and enterprise sectors across Latin America. Its focus areas include technical and operational auditing, risk assessment, and strategic consultancy to facilitate robust network systems and software solutions.

📋 Description

• Perform advanced investigations of complex alerts, correlating logs from multiple sources such as endpoints, firewalls, network devices, and cloud environments. • Manage the incident response lifecycle, from technical containment to recommending eradication measures. • Execute threat hunting activities, proactively searching for threats that did not trigger automated alerts. • Administer and configure next-generation firewalls (NGFW), including access control lists (ACLs), IPS/IDS policies, content filtering, and SSL inspection. • Manage endpoint protection platforms (EDR/XDR), including alert analysis, creation of exclusion policies, and performing remote scans. • Analyze security logs and events in SIEM tools, creating queries and dashboards to identify attack patterns. • Provide technical support to the Level 1 team, refining playbooks and correlation rules to reduce false positives. • Document incidents, investigations, evidence, and post-incident technical reports (post-mortems).

🎯 Requirements

• Minimum 2 to 3 years of experience in security operations or incident response. • Knowledge of network infrastructure, including routing protocols, VLANs, and security-focused network segmentation. • Experience administering firewalls (Fortinet, Palo Alto, Check Point, or similar) and VPNs. • Proficiency with EDR/XDR platforms (CrowdStrike, SentinelOne, Microsoft Defender, Trend Micro, Bitdefender, or similar). • Experience in log analysis and SIEM usage, including creating queries and dashboards (KQL, SPL, or Lucene). • Ability to analyze traffic and reconstruct attacks using PCAPs and Proxy/WAF logs. • Knowledge of the MITRE ATT&CK framework for identifying adversary tactics and techniques.