CSOC L2 Support Expert – Managed Detection & Response (SIRT)

Job summary

Monitor security telemetry and investigate escalated incidents, providing forensic analysis and containment and mitigation guidance. Document incident scope, root cause, and remediation; coordinate response stakeholders; and contribute to reporting, detection tuning, threat hunting, and SOAR automation.

Job details

CSOC L2 Support Expert – Managed Detection & Response (SIRT) Ontario, Canada (Remote) Full-Time Job Summary: As a CSOC L2 Support Expert, the candidate will provide advanced investigation and incident response within the client's Cyber Security Operations Center. The role correlates and investigates escalated alerts, leads containment guidance, documents incidents end to end and identifies SOAR automation to improve detection and response efficiency. Due to data residency requirements, this role must be delivered from the United States, Canada, UK or EU. Role and Responsibilities: Continuously monitor the global environment using the client's security controls (SIEM, EDR, email, network and cloud telemetry). Correlate, triage and investigate escalated security incidents from L1. Follow and maintain incident-response runbooks and workflows. Provide advanced investigation, forensic, containment and mitigation guidance. Document attacks, scope, root cause and remediation for every incident. Coordinate incident-response stakeholders across IT, business units and third parties. Identify and propose SOAR automation opportunities to reduce manual effort. Produce incident reports, weekly status reports, monthly executive summaries, quarterly workshops and IRW documentation. Contribute to detection tuning feedback and threat-hunting activities. Key Skills: At least 6+ years of experience in IT with 4+ years in SOC / incident response at L2 or above. Hands-on experience with SIEM platforms (Splunk, Microsoft Sentinel, QRadar or similar). Strong experience with EDR tools such as CrowdStrike Falcon or Microsoft Defender for Endpoint. Working knowledge of SOAR platforms (Splunk SOAR, Cortex XSOAR, Sentinel playbooks). Strong understanding of MITRE ATT&CK, cyber kill chain and incident response lifecycle (NIST 800-61). Experience with host and network forensics, log analysis and malware triage. Knowledge of Windows, Linux, Active Directory, cloud (AWS/Azure) and email security attack patterns. Scripting skills (Python, PowerShell, KQL/SPL) for investigation and automation. Experience in financial services or other regulated industries preferred. Must be eligible to work in the US, Canada, UK or EU. Excellent written communication for incident and executive reporting. High level of initiative and ownership mentality. Education & Certifications: - B.Tech / B.E / M.Tech / MCA OR Any PG (Computer Science, IT, Information Security or related discipline). Technical Certifications are desired and a plus, such as: GIAC GCIH / GCIA / GCFA, CompTIA CySA+, Splunk Core Certified Power User, Microsoft SC-200, CrowdStrike CCFR. About Solugenix Solugenix is a leader in IT services, delivering cutting-edge technology solutions, exceptional talent, and managed services to global enterprises. With extensive expertise in highly regulated and complex industries, we are a trusted partner for integrating advanced technologies with streamlined processes. Our solutions drive growth, foster innovation, and ensure compliance providing clients with reliability and a strong competitive edge. Recognized as a 2024 Top Workplace, Solugenix is proud of its inclusive culture and unwavering commitment to excellence. Our recent expansion, with new offices in the Dominican Republic, Jakarta, and the Philippines, underscores our growing global presence and ability to offer world-class technology solutions. Partnering with Solugenix means more than just business it means having a dedicated ally focused on your success in today's fast-evolving digital world.

What you’ll do

Monitor security telemetry and investigate escalated incidents, providing forensic analysis and containment and mitigation guidance. Document incident scope, root cause, and remediation; coordinate response stakeholders; and contribute to reporting, detection tuning, threat hunting, and SOAR automation.

Requirements

Requires at least six years of IT experience, including four or more years in SOC or incident response at L2 or above, with hands-on SIEM and EDR experience and working knowledge of SOAR. Candidates should understand incident response frameworks, forensics, malware triage, operating systems, cloud and email security, and scripting; a relevant degree or postgraduate qualification is listed, and technical certifications are desired.

Listed skills

• Amazon Web Services · Preferred
• Python · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Security Operations Center
• Incident Response
• SIEM
• Endpoint Detection and Response
• SOAR
• Threat Hunting
• Digital Forensics
• Log Analysis
• Malware Triage
• MITRE ATT&CK
• NIST 800-61
• Python
• PowerShell
• KQL
• SPL
• AWS

Job areas

• Security & Safety
• Technology
• Customer Service & Support

More jobs from Solugenix