SOC L2 Specialist - (Saudi National Only)

Location: Riyadh, Saudi Arabia Role Summary The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity. Key Responsibilities Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning Lead incident response: containment, eradication, recovery and root cause analysis Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats Tune SIEM correlation rules and use cases to reduce false positives Run threat hunting based on threat intelligence and MITRE ATT&CK Create and maintain incident response playbooks and SOAR workflows Supervise and mentor L1 analysts, review their work, and manage shift handovers Write incident reports and present findings to technical and management stakeholders Report incidents in line with NCA requirements and SMC's escalation matrix Track SOC KPIs such as MTTD, MTTR and SLA compliance. Requirements Bachelor's degree in Cybersecurity, Computer Science, IT or related field 4–6 years in a SOC, with at least 2 years at L2 level Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar) Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols Experience in an enterprise or managed SOC (MSSP) environment Saudi national, fluent in Arabic and English Willing to support on-call or shift rotation if required Preferred Certifications GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification