NOC Tier 2 Engineer

The Tier-2 NOC Engineer takes escalations from Tier-1 and restores service across our customer contracts, which span on-premises, Microsoft Azure and AWS environments, each with its own SLA. You will troubleshoot across network, compute, operating system, database, application and cloud layers, engage vendors and internal teams, and keep customers informed during major incidents.

You will also make the NOC better over time: tuning noisy alerts, writing and automating runbooks, and raising problem records so recurring issues are fixed for good. You will work closely with the SOC, providing infrastructure data during security investigations.

Key Responsibilities:

• Diagnose and Restore
• Take escalated tickets from Tier-1 and troubleshoot across network, compute, OS, database, application and cloud layers.
• Restore service through fixes, failover, scaling, or rolling back a bad change, within contract SLAs.
• Identify the likely root cause and record it, with resolution notes, in the ticket.
• Change Management
• Raise and implement emergency changes needed to restore service.
• Roll back changes that cause incidents, and check whether a recent change caused an incident.
• Execute critical out-of-band patches when requested by the SOC and validate service health after patching.
• Coordination and Communication
• Engage vendors (Oracle, Microsoft, AWS, ISPs and others) and internal infrastructure and application teams.
• Send status updates to customers and stakeholders on each contract's schedule during P1/P2 incidents.
• Collect and provide data (logs, configurations, flow data) to the SOC on request during security investigations.
• Continuous Improvement
• Raise problem records for recurring or unexplained issues.
• Tune alerts: remove noisy ones, adjust thresholds, and action false-positive tuning requests from Tier-1.
• Write and improve runbooks and automate common fixes so Tier-1 can resolve more issues at first contact.
• Coach Tier-1 analysts on troubleshooting and runbook use.

Scope and Escalation Boundaries:

• Inputs this role works from
• Escalated tickets from Tier-1 with triage evidence
• Monitoring data across all tools, CMDB/service maps per contract, change records and vendor contacts
• Requests from SOC Tier-2 for infrastructure data
• Escalate to NOC Tier-3 / engineering when
• The root cause is outside standard operations (code defect, architecture limit, product/IoT firmware, capacity design).
• A fix needs a significant change or design decision.
• The issue is not resolved within the P1/P2 time limit (e.g., 1 hour of active work on a P1).
• Escalate to the Incident Commander (war room) when
• There is a major incident: several contracts affected, a full customer outage, a likely SLA breach with penalties, or a possible security cause.

Required Skills:

• Technical Depth
• Hands-on depth in at least two of the following, with working knowledge of the rest:
• Network: TCP/IP, OSI model, routing and switching, firewalls, VPN, DNS, DHCP, load balancers, network connectivity troubleshooting.
• Systems: Windows Server, Active Directory, Linux administration.
• Databases: Oracle and Microsoft SQL Server (performance, blocking, storage, job failures).
• Cloud: Microsoft Azure and AWS (compute, networking, identity, monitoring).
• Applications: Java-based applications, web and application servers, application logs.
• Working knowledge of the products and IoT devices for the contracts supported.
• Log analysis across firewalls, routers, switches, servers and applications.
• Monitoring and Observability Tools
• SolarWinds: NPM, NetFlow analysis, node and interface health.
• AppDynamics: transaction tracing and application performance analysis.
• Oracle Enterprise Manager: database and middleware performance analysis.
• Site24x7: synthetic monitoring and availability checks.
• Azure Monitor and AWS CloudWatch: metrics, alarms and log queries.
• PRTG Network Monitor and Nagios
• Ticketing systems (ServiceNow, Jira or similar) and Microsoft 365.
• Scripting standards this role follows:
• All scripts kept in Git in an approved, peer-reviewed library.
• Read-only by default: diagnostic scripts never change anything; scripts that make changes need a change or ticket reference.
• No hard-coded credentials: credentials are pulled from a vault.
• Parameterized by contract and CI, safe to run twice, and logging what they did into the ticket.
• Process Skills
• ITIL incident, problem and change management, including emergency changes and rollbacks.
• Vendor escalation and management.
• Shift handover and incident documentation.
• Professional Skills
• Structured, analytical troubleshooting under pressure.
• Clear written and verbal technical updates for both technical and customer audiences.
• Attention to detail, and the ability to manage several incidents at once.

Preferred Skills:

• Python for automation that spans several systems (e.g., one script that checks a service across Azure, AWS and on-premises).
• Splunk SPL basics.
• Network device CLI for reading switch, router and firewall state.
• Experience in a multi-customer or managed services NOC with contract-specific SLAs.

Certifications (Preferred):

• ITIL 4 Foundation
• CCNA or CompTIA Network+
• Microsoft Certified: Azure Administrator Associate (AZ-104)
• AWS Certified SysOps Administrator - Associate
• CompTIA Security+

Skills

AWS, Active Directory, AppDynamics, Azure, CloudWatch, DHCP, DNS, Firewalls, Linux, Nagios, PRTG, SolarWinds, TCP/IP, VPN, Windows Server