{"id":2966347,"url":"https://alion.io/job/evocs-soc-analyst-l2","title":"Soc Analyst - L2","company":{"id":3907424,"name":"Evocs","domain":"evocs.tech","url":"https://alion.io/company/evocs","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Denver, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":83000,"max_usd":159000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":460},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"DNS","optional":false},{"name":"FortiGate","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"TCP/IP","optional":false},{"name":"VPN","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-20T21:24:57Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-23T04:37:15Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"EVOCS OVERVIEW\nEVOCS was founded with a clear purpose: to help businesses operate more effectively, solve complex challenges, and create opportunities for growth through practical expertise and technology solutions.\nAs an IT consulting firm, we work with our clients to understand their needs, identify the right technologies, and deliver solutions that improve performance and support their business objectives.\nToday, EVOCS is a trusted technology partner to a growing number of organizations and industry leaders. Our team combines technical expertise, business understanding, and a commitment to quality to deliver effective solutions and build lasting client relationships based on responsiveness, consistency, and results.\nEVOCS Overview\nEVOCS's journey began with a mission to empower businesses with advisory expertise, empowered with ideal technologies to provide them with comprehensive solutions to grow and prosper.\nFounded by a team of passionate experts, EVOCS has grown into a trusted partner to a growing number of leaders across their respective industries. Our roots in employee-managed operations reflect our commitment to quality, consistency, and client success.\nIf you enjoy working in a hyper-fast-growing company, are eager to be part of an agile team, and want to be part of our success story, then let's talk!\nRole Overview\nAs a SOC Analyst L2, you will own escalated incidents from investigation through containment across FortiSIEM, FortiSOAR and Microsoft Defender XDR.\nYou will be responsible for finding root cause, driving response, sharpening detections and automation, and raising the bar for the L1 analysts who escalate to you.\nWhat You Will Do\nIn this role, you will:\nInvestigation & Hunting\nInvestigate incidents escalated from L1: build the full timeline, determine scope and root cause, and confirm impact\nCorrelate endpoint, identity, email and network telemetry across Defender for Endpoint, Defender for Identity, Defender for Office 365 and FortiGate / FortiSIEM logs\nHunt proactively with Defender XDR advanced hunting (KQL) and FortiSIEM searches, mapped to MITRE ATT&CK\nIncident Response\nLead containment and eradication - device isolation, account disablement, indicator blocking, malicious email purge - coordinating with IT and network teams\nWrite incident reports covering timeline, root cause, actions taken and recommendations; brief client stakeholders on high-severity events\nSupport major incident response and escalate to L3, IR or threat intel when required\nDetection Engineering & Automation\nBuild, tune and retire FortiSIEM correlation rules, watchlists and reports to cut false positives and close detection gaps\nDesign and maintain FortiSOAR playbooks for enrichment, triage and automated response\nTune Defender policies, custom detections, suppression rules and alert thresholds\nMentorship & Continuous Improvement\nAct as escalation point and mentor for L1 - review case quality, coach on investigations and update runbooks\nTrack SOC metrics (MTTD, MTTR, false-positive rate) and recommend process improvements\nWhat You Will Bring\nThe top candidate will have the following skills:\n3-5 years of hands-on experience as an analyst in a Security Operations Center (SOC), including at least 1-2 years at L2 or in incident response - required; IT support or NOC experience alone does not qualify\nExperience with FortiSIEM (searches, correlation rules, parsers); FortiSOAR (case handling, playbook building); Microsoft Defender XDR and Defender for Endpoint; KQL advanced hunting; MITRE ATT&CK; incident containment\nDeep networking and security knowledge: TCP/IP, DNS, firewalls (FortiGate a plus), proxies, VPN and packet analysis\nExperience with Windows and Linux log analysis, Active Directory and Entra ID sign-in logs\nA passion for turning recurring manual work into tuned detections and automated playbooks\nAn undying concern about detection gaps and threats that slip past the queue\nFluent in English (written and spoken) - bilingual or near-native level\nStrong interpersonal and communication skills - this is a client-facing role that involves frequent interaction via email, calls, and meetings\nIdeally you have…\nA degree in Cybersecurity, Information Technology, or a related field\nScripting for automation and analysis - Python, PowerShell, REST APIs\nExperience with Microsoft Sentinel, Defender for Cloud or Defender for Cloud Apps; MSSP or multi-tenant SOC experience\nCertifications such as Microsoft SC-200, Fortinet FCP / NSE 5 (FortiSIEM or FortiSOAR), CompTIA CySA+, GCIH, GCIA, or BTL1 / BTL2\nPay Range for jobs in the US.\nPay Range\n$60—$75 USD\nOur Values\nWe are privileged to serve our loyal customer base in our mission to build lasting relationships with our clients based on trust and mutual success. We strive to deliver exceptional quality and consistency through a white-glove approach. By empowering businesses with tailored solutions and insights, we help them achieve their goals and navigate the ever-evolving tech landscape.\nThe values we live by:\nCustomer-centric Solutions\nInnovation & Excellence\nIntegrity & Transparency\nData-driven Decision Making\nNeed to Know\nThe posting will be active for a minimum of 3 days. The active posting will continue to extend by 3 days until the position is filled.\nAll qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or protected veteran status, or any other legally protected basis, in accordance with applicable law.","description_format":"text","description_chars":5571,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","IT Consulting & Digital Transformation","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-10-21T00:16:50Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":2,"expected_fill_days":50,"reasons":["conf:1","win:early"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/evocs-soc-analyst-l2","json_url":"https://alion.io/job/evocs-soc-analyst-l2.json","meta":{"generated_at":"2026-10-23T08:58:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14419,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3907424},"rest":"https://alion.io/mcp/rest/get_company?id=3907424"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fevocs-soc-analyst-l2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fevocs-soc-analyst-l2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fevocs-soc-analyst-l2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/evocs-soc-analyst-l2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fevocs-soc-analyst-l2"}]}