{"id":4150141,"url":"https://alion.io/job/caliberly-l2-security-analyst","title":"L2 Security Analyst","company":{"id":4479767,"name":"Caliberly","domain":"caliberly.com","url":"https://alion.io/company/caliberly","size_band":"51-200","is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":"Manatal","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Dubai, United Arab Emirates"],"countries":["AE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-11-12T08:50:11Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T08:50:11Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job Title - L2 Security Analyst\nJOB DESCRIPTION\nThe L2 Security Analyst will be responsible for investigating, analysing and responding to security incidents across the organisation's security environment. The role requires hands-on experience with Microsoft Sentinel, CrowdStrike and Microsoft Defender, with a strong focus on threat detection, incident response and security monitoring.\nKey Responsibilities\n1. Security Monitoring & Incident Investigation\nMonitor and investigate security alerts escalated from L1 SOC analysts.\nPerform in-depth analysis of security events to identify potential threats, suspicious activities and indicators of compromise (IOCs).\nInvestigate complex security incidents and determine their scope, impact and severity.\nCorrelate security events across multiple sources to identify attack patterns.\n2. SIEM - Microsoft Sentinel\nMonitor and investigate security incidents using Microsoft Sentinel.\nDevelop, modify and optimise KQL queries for threat hunting and incident investigation.\nAnalyse logs and security events from endpoints, networks, cloud environments and Microsoft 365.\nSupport the development and tuning of analytics rules, workbooks and detection use cases.\n3. Endpoint Security - CrowdStrike & Microsoft Defender\nMonitor and investigate endpoint security alerts using CrowdStrike Falcon.\nPerform endpoint threat analysis, malware investigation and suspicious process analysis.\nUtilise Microsoft Defender for Endpoint to investigate threats, assess endpoint exposure and support incident containment.\nCoordinate endpoint isolation, remediation and recovery activities.\nIdentify recurring endpoint threats and recommend preventive security measures.\n4. Threat Hunting & Incident Response\nConduct proactive threat hunting to identify hidden or emerging threats.\nAnalyse IOCs, TTPs and attack patterns using MITRE ATT&CK.\nSupport incident containment, eradication and recovery.\nPrepare detailed incident reports and recommend corrective actions.\n5. Reporting & Escalation\nPrepare incident investigation reports and maintain accurate case documentation.\nEscalate critical security incidents to L3 or relevant stakeholders.\nSupport L1 analysts through technical guidance and knowledge sharing.\nContribute to continuous improvement of SOC processes and detection capabilities.\nRequired Technical Skills\nHands-on experience with Microsoft Sentinel (SIEM).\nStrong practical experience with CrowdStrike Falcon (EDR).\nExperience with Microsoft Defender for Endpoint and Microsoft security ecosystem.\nProficiency in KQL for security investigation and threat hunting.\nStrong understanding of SIEM, EDR, XDR and SOC operations.\nKnowledge of incident response, malware analysis and endpoint investigation.\nFamiliarity with MITRE ATT&CK framework and threat intelligence.\nUnderstanding of Windows operating systems, Active Directory and network security fundamentals.\nQualifications & Experience\nBachelor's degree in Computer Science, Information Security, Cybersecurity or a related discipline.\n3-5 years of experience in SOC operations or cybersecurity.\nMinimum 2 years of hands-on experience in security monitoring and incident investigation.\nRelevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ or equivalent are desirable.\nKey Competencies\nStrong analytical and problem-solving skills.\nAbility to investigate and prioritise security incidents independently.\nGood communication and technical reporting skills.\nAbility to work in a 24/7 SOC shift environment, where required.\nStrong attention to detail and ownership of incident resolution.\nRequired Technical Skills\nHands-on experience with Microsoft Sentinel (SIEM).\nStrong practical experience with CrowdStrike Falcon (EDR).\nExperience with Microsoft Defender for Endpoint and Microsoft security ecosystem.\nProficiency in KQL for security investigation and threat hunting.\nStrong understanding of SIEM, EDR, XDR and SOC operations.\nKnowledge of incident response, malware analysis and endpoint investigation.\nFamiliarity with MITRE ATT&CK framework and threat intelligence.\nUnderstanding of Windows operating systems, Active Directory and network security fundamentals.\nQualifications & Experience\nBachelor's degree in computer science, Information Security, Cybersecurity or a related discipline.\n5+ years of experience in SOC operations or cybersecurity.\nMinimum 2 years of hands-on experience in security monitoring and incident investigation.\nRelevant certifications such as SC-200, AZ-500, CrowdStrike certifications, Security+ or equivalent are desirable.\nApply now!","description_format":"text","description_chars":4592,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response"],"lifecycle":[{"event":"open","at":"2026-11-12T08:50:11Z"}],"visa":[],"liveness":{"score":52,"band":"ok","label":"Likely open","p_open":1,"p_active":0.516,"p_room":1,"age_days":0,"expected_fill_days":30,"reasons":["conf:1","agency","win:early","comp:brand"],"computed_at":"2026-11-12T10:42:24Z"},"pay":null,"html_url":"https://alion.io/job/caliberly-l2-security-analyst","json_url":"https://alion.io/job/caliberly-l2-security-analyst.json","meta":{"generated_at":"2026-11-12T10:42:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21945,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4479767},"rest":"https://alion.io/mcp/rest/get_company?id=4479767"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcaliberly-l2-security-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcaliberly-l2-security-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcaliberly-l2-security-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/caliberly-l2-security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcaliberly-l2-security-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4150141}},{"tool":"search_jobs","arguments":{"company":"caliberly.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4150141},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}