Soc Analyst - L2
Evolution Cloud Services · Denver · $60–$75/hr (stated in the posting)
EVOCS OVERVIEW
EVOCS was founded with a clear purpose: to help businesses operate more effectively, solve complex challenges, and create opportunities for growth through practical expertise and technology solutions.
As an IT consulting firm, we work with our clients to understand their needs, identify the right technologies, and deliver solutions that improve performance and support their business objectives.
Today, EVOCS is a trusted technology partner to a growing number of organizations and industry leaders. Our team combines technical expertise, business understanding, and a commitment to quality to deliver effective solutions and build lasting client relationships based on responsiveness, consistency, and results.
EVOCS Overview
EVOCS's journey began with a mission to empower businesses with advisory expertise, empowered with ideal technologies to provide them with comprehensive solutions to grow and prosper.
Founded by a team of passionate experts, EVOCS has grown into a trusted partner to a growing number of leaders across their respective industries. Our roots in employee-managed operations reflect our commitment to quality, consistency, and client success.
If you enjoy working in a hyper-fast-growing company, are eager to be part of an agile team, and want to be part of our success story, then let's talk!
🎯 Role Overview
As a SOC Analyst L2, you will own escalated incidents from investigation through containment across FortiSIEM, FortiSOAR and Microsoft Defender XDR.
You will be responsible for finding root cause, driving response, sharpening detections and automation, and raising the bar for the L1 analysts who escalate to you.
🧩 What You Will Do
In this role, you will:
Investigation & Hunting
- Investigate incidents escalated from L1: build the full timeline, determine scope and root cause, and confirm impact
- Correlate endpoint, identity, email and network telemetry across Defender for Endpoint, Defender for Identity, Defender for Office 365 and FortiGate / FortiSIEM logs
- Hunt proactively with Defender XDR advanced hunting (KQL) and FortiSIEM searches, mapped to MITRE ATT&CK
Incident Response
- Lead containment and eradication — device isolation, account disablement, indicator blocking, malicious email purge — coordinating with IT and network teams
- Write incident reports covering timeline, root cause, actions taken and recommendations; brief client stakeholders on high-severity events
- Support major incident response and escalate to L3, IR or threat intel when required
Detection Engineering & Automation
- Build, tune and retire FortiSIEM correlation rules, watchlists and reports to cut false positives and close detection gaps
- Design and maintain FortiSOAR playbooks for enrichment, triage and automated response
- Tune Defender policies, custom detections, suppression rules and alert thresholds
Mentorship & Continuous Improvement
- Act as escalation point and mentor for L1 — review case quality, coach on investigations and update runbooks
- Track SOC metrics (MTTD, MTTR, false-positive rate) and recommend process improvements
🧠 What You Will Bring
The top candidate will have the following skills:
- 3–5 years of hands-on experience as an analyst in a Security Operations Center (SOC), including at least 1–2 years at L2 or in incident response — required; IT support or NOC experience alone does not qualify
- Experience with FortiSIEM (searches, correlation rules, parsers); FortiSOAR (case handling, playbook building); Microsoft Defender XDR and Defender for Endpoint; KQL advanced hunting; MITRE ATT&CK; incident containment
- Deep networking and security knowledge: TCP/IP, DNS, firewalls (FortiGate a plus), proxies, VPN and packet analysis
- Experience with Windows and Linux log analysis, Active Directory and Entra ID sign-in logs
- A passion for turning recurring manual work into tuned detections and automated playbooks
- An undying concern about detection gaps and threats that slip past the queue
- Fluent in English (written and spoken) – bilingual or near-native level
- Strong interpersonal and communication skills – this is a client-facing role that involves frequent interaction via email, calls, and meetings
Ideally you have…
- A degree in Cybersecurity, Information Technology, or a related field
- Scripting for automation and analysis — Python, PowerShell, REST APIs
- Experience with Microsoft Sentinel, Defender for Cloud or Defender for Cloud Apps; MSSP or multi-tenant SOC experience
- Certifications such as Microsoft SC-200, Fortinet FCP / NSE 5 (FortiSIEM or FortiSOAR), CompTIA CySA+, GCIH, GCIA, or BTL1 / BTL2
#LI-Onsite
Pay Range for jobs in the US.
👥 Our Values
We are privileged to serve our loyal customer base in our mission to build lasting relationships with our clients based on trust and mutual success. We strive to deliver exceptional quality and consistency through a white-glove approach. By empowering businesses with tailored solutions and insights, we help them achieve their goals and navigate the ever-evolving tech landscape.
The values we live by:
- Customer-centric Solutions
- Innovation & Excellence
- Integrity & Transparency
- Data-driven Decision Making
📝 Need to Know
The posting will be active for a minimum of 3 days. The active posting will continue to extend by 3 days until the position is filled.
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or protected veteran status, or any other legally protected basis, in accordance with applicable law.
More jobs at Evolution Cloud Services · Security jobs in Denver