SOC Analyst, Tier 2

<div class="content-intro"><p><strong>Build the Future with AspenView Technology Partners</strong></p> <p>At AspenView, we are passionate about transforming the way organizations approach technology. We specialize in creating high-performing, nearshore IT teams to help North American clients innovate faster and more efficiently.</p> <p>As we continue to grow, we’re looking for exceptional people to join our team and help drive impactful change across industries.</p></div><p>&nbsp;</p> <p><strong>Why Join AspenView?</strong></p> <p>At AspenView, we’re more than a nearshore IT partner—we’re a <strong>people-first, purpose-driven</strong> company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.</p> <p>Here’s what you can expect:</p> <ul data-pattern="discCircleSquare" data-depth="1"> <li>Competitive base</li> <li>Flexible work model: hybrid, remote, or in-office</li> <li>Real growth opportunities and leadership visibility</li> <li>Inclusive, respectful culture that blends U.S. innovation with Colombian heart</li> <li>A company that listens, invests in you, and celebrates wins together</li> </ul> <p data-path-to-node="24">&nbsp;</p> <p id="p-rc_ccaccbb877d98366-452" data-path-to-node="12"><span data-path-to-node="12,2"><span data-path-to-node="12,0">The <strong>Tier 2 SOC Analyst</strong> is a senior escalation point and operational leader within the security operations team, serving a US higher-education client</span>. You take what Tier 1 escalates, scope the incident, execute containment within your authority, and make the critical call on when to wake a client's dedicated security engineer</span><span data-path-to-node="12,4">. Moving beyond simply processing a queue, you will actively tune detection rules to eliminate noise, ensuring the queue is trusted and accurate</span><span data-path-to-node="12,6">. This role offers protected time to improve detection content and serves as a natural progression path toward a dedicated client-facing engineering role</span><span data-path-to-node="12,8">.</span></p> <p data-path-to-node="13"><strong data-path-to-node="13" data-index-in-node="0">What you will do:</strong></p> <p data-path-to-node="14"><strong data-path-to-node="14" data-index-in-node="0">Incident Escalation &amp; Containment</strong></p> <ul data-path-to-node="15"> <li> <p id="p-rc_ccaccbb877d98366-453" data-path-to-node="15,0,0"><span data-path-to-node="15,0,0,0">Own escalations from Tier 1, taking responsibility for scoping, enrichment, and deciding if an event constitutes a true incident</span><span data-path-to-node="15,0,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-454" data-path-to-node="15,1,0"><span data-path-to-node="15,1,0,0">Execute containment actions (host isolation, account disablement, edge blocking) following client rules of engagement, balancing swift action with the judgment to not break production environments</span><span data-path-to-node="15,1,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-455" data-path-to-node="15,2,0"><span data-path-to-node="15,2,0,0">Manage the handover process and make the decision to wake the client's dedicated engineer when necessary</span><span data-path-to-node="15,2,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-456" data-path-to-node="15,3,0"><span data-path-to-node="15,3,0,0">Produce incident write-ups that are clear and accessible enough for a client CIO to read without a translator</span><span data-path-to-node="15,3,0,2">.</span></p> </li> </ul> <p data-path-to-node="16"><strong data-path-to-node="16" data-index-in-node="0">Detection Engineering &amp; Mentorship</strong></p> <ul data-path-to-node="17"> <li> <p id="p-rc_ccaccbb877d98366-457" data-path-to-node="17,0,0"><span data-path-to-node="17,0,0,0">Improve detection content by tuning rules, cutting false positives, and proposing new analytics to close visibility gaps</span><span data-path-to-node="17,0,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-458" data-path-to-node="17,1,0"><span data-path-to-node="17,1,0,0">Coach and mentor Tier 1 analysts, treating their escalation quality as a direct reflection of your output</span><span data-path-to-node="17,1,0,2">.</span></p> </li> </ul> <p data-path-to-node="18"><strong data-path-to-node="18" data-index-in-node="0">Tools &amp; Technologies:</strong></p> <ul data-path-to-node="19"> <li> <p id="p-rc_ccaccbb877d98366-459" data-path-to-node="19,0,0"><span data-path-to-node="19,0,0,0"><strong data-path-to-node="19,0,0,0" data-index-in-node="0">SIEM:</strong> Microsoft Sentinel in depth, including writing and tuning analytics rules in KQL</span><span data-path-to-node="19,0,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-460" data-path-to-node="19,1,0"><span data-path-to-node="19,1,0,0"><strong data-path-to-node="19,1,0,0" data-index-in-node="0">Cloud Security:</strong> Entra ID and identity attack paths (OAuth consent abuse, token theft, privilege escalation)</span><span data-path-to-node="19,1,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-461" data-path-to-node="19,2,0"><span data-path-to-node="19,2,0,0"><strong data-path-to-node="19,2,0,0" data-index-in-node="0">Automation (Bonus):</strong> SOAR playbooks, Logic Apps, Python</span><span data-path-to-node="19,2,0,2">.</span></p> </li> </ul> <p data-path-to-node="20"><strong data-path-to-node="20" data-index-in-node="0">What you bring:</strong></p> <ul data-path-to-node="21"> <li> <p id="p-rc_ccaccbb877d98366-462" data-path-to-node="21,0,0"><span data-path-to-node="21,0,0,0"><strong data-path-to-node="21,0,0,0" data-index-in-node="0">Experience:</strong> Four or more years in security operations, with genuine escalation ownership rather than just accumulating queue time</span><span data-path-to-node="21,0,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-463" data-path-to-node="21,1,0"><span data-path-to-node="21,1,0,0"><strong data-path-to-node="21,1,0,0" data-index-in-node="0">Hands-on Skills:</strong> Deep Microsoft Sentinel and KQL experience, and the ability to walk through an incident response end-to-end—including a case that went badly and how you adapted</span><span data-path-to-node="21,1,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-464" data-path-to-node="21,2,0"><span data-path-to-node="21,2,0,0"><strong data-path-to-node="21,2,0,0" data-index-in-node="0">Communication:</strong> Fluent English, strong enough to confidently brief a client executive directly, both in writing and on a call</span><span data-path-to-node="21,2,0,2">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-465" data-path-to-node="21,3,0"><span data-path-to-node="21,3,0,0"><strong data-path-to-node="21,3,0,0" data-index-in-node="0">Mindset:</strong> Judgement-oriented and proactive. You have the confidence to contain threats without breaking production, and the humility to admit when containment is the wrong call</span><span data-path-to-node="21,3,0,2">. You are expected to improve detection content, not only consume it</span><span data-path-to-node="21,3,0,4">.</span></p> </li> <li> <p id="p-rc_ccaccbb877d98366-466" data-path-to-node="21,4,0"><span data-path-to-node="21,4,0,0"><strong data-path-to-node="21,4,0,0" data-index-in-node="0">Availability:</strong> Ability to work extended business hours and share an on-call rotation for overnight escalations</span><span data-path-to-node="21,4,0,2">.</span></p> </li> </ul> <p id="p-rc_ccaccbb877d98366-467" data-path-to-node="22"><span data-path-to-node="22,0"><strong data-path-to-node="22,0" data-index-in-node="0">Bonus Qualifications:</strong> Formal detection engineering experience, threat intelligence or purple-team exposure, or automation skills</span><span data-path-to-node="22,2">. Relevant certifications such as SC-200, GCIA, GCIH, or equivalent, and experience in regulated environments (education, healthcare, or financial services)</span><span data-path-to-node="22,4">.</span></p> <p id="p-rc_212fae10b356a9c2-347" data-path-to-node="24"></p> <p id="p-rc_a5475eca20adde29-204" data-path-to-node="26,2,0"></p><div class="content-conclusion"><p><strong>Visa Sponsorship</strong></p> <p>AspenView does not sponsor employment visas for this role. Applicants must be permanently authorized to work in their country of residence and must not require visa sponsorship now or in the future.</p> <p><strong>Equal Opportunity Employer</strong></p> <p>AspenView is proud to be an equal opportunity employer. We believe in creating an environment where all employees feel welcome, valued, and empowered to succeed. We celebrate diversity and strive to build a culture of inclusion where all individuals, regardless of their race, color, gender, gender identity or expression, sexual orientation, disability, age, or any other characteristic, can thrive. We encourage applicants from all walks of life to join our team and make a lasting impact.</p></div>