Security Operations Center Analyst L2 in Leeds

Communicate SOC is seeking an experienced and proactive L2 SOC Analyst to join our growing Managed Security Services team. Working within our Security Operations Centre (SOC), you will play a key role in protecting client environments through threat detection, incident investigation, response activities, and the continual improvement of security monitoring capabilities.

As an L2 Analyst, you will act as an escalation point for Tier 1 analysts, investigating complex security events, engaging with incident response activities, and supporting the development of detection capabilities across multiple customer environments. This role offers exposure to a broad range of security technologies and opportunities to further develop your technical expertise within a fast-paced MSSP environment.

This role operates in a staggered shift between Monday-Friday 0830—1730 and all team members are required to participate in an on-call rota to support continuous monitoring and incident response.

Key Responsibilities

Security Monitoring & Investigation

• Investigate security alarms end-to-end and validate escalations from Tier 1 analysts.
• Analyse logs, alerts, and threat intelligence to determine the scope, impact, and root cause of security incidents.
• Correlate events across multiple security technologies to identify malicious activity, attack patterns, and indicators of compromise (IOCs).
• Act as a technical escalation point, providing guidance and support to junior analysts.
• Document investigations, findings, and remediation actions within case management systems.
• Ensure incidents are prioritised and managed in line with customer requirements and service levels.
• Conduct detailed investigations and support response activities for security incidents, including phishing, malware, credential compromise, and other cyber threats, ensuring timely and effective remediation.
• Coordinate and execute containment, eradication, and recovery activities in line with approved response procedures, including actions such as endpoint isolation, account containment, and IOC blocking.
• Provide clear updates and technical summaries to internal teams and customer stakeholders.
• Produce incident reports and contribute to post-incident reviews and lessons learned activities.

SOC Development

• Develop and tune detection rules, use cases, and alert logic to improve detection quality and reduce false positives.
• Create and maintain operational documentation, including playbooks, runbooks, and knowledge articles.
• Contribute to improvements across SIEM, EDR/XDR, SOAR, and related security technologies.
• Identify gaps in monitoring coverage and recommend enhancements to SOC processes and tooling.
• Support customer onboarding activities, ensuring monitoring and response requirements are implemented effectively.

Professional Development

• Maintain awareness of emerging threats, vulnerabilities, and attack techniques.
• Contribute to knowledge sharing and support the development of Tier 1 analysts.
• Participate in training, certifications, technical exercises, and threat hunting activities.
• Support a culture of continuous improvement across the SOC.

Skills & Requirements

• Experience working within a SOC, MSSP, MDR, or cyber security operations environment.
• Experience investigating and responding to security incidents across endpoint, network, cloud, and identity platforms.
• Strong understanding of security operations, incident response, and threat detection methodologies.
• Hands-on experience with SIEM platforms such as CrowdStike NGS, Microsoft Sentinel, Splunk, QRadar, or similar.
• Expertise with EDR/XDR technologies, including Microsoft Defender XDR and CrowdStrike.
• Good working knowledge of Windows, Active Directory, Microsoft 365, networking, and authentication technologies.
• Ability to analyse security events, correlate data from multiple sources, and make risk-based decisions.
• Strong analytical, problem-solving, and communication skills.
• Experience creating technical documentation and maintaining accurate incident records.
• Relevant certifications such as SC-200, Security+, CySA+, AZ-500, or equivalent experience are desirable.

This role is ideal for an established Tier 1 analyst looking to progress into a more investigative and technically focused role, or an existing Tier 2 analyst seeking broader exposure within a managed security services environment.

#J-18808-Ljbffr