SOC L2 Analyst - Incident Response

About the role

Raqami Bank is hiring an Officer SOC L2 in its Information Security department. The role supports and assists in investigating, containing and resolving cybersecurity incidents escalated from SOC L1, helping to detect genuine threats, minimise business impact and protect the bank's information assets in line with approved incident response procedures, SBP cybersecurity requirements, ISO/IEC 27001 and the bank's information security policies. It works in a 24x7 SOC environment, including rotational shifts.

Key responsibilities

• Analyse security alerts escalated from SOC L1 and investigate incidents such as malware, phishing, account compromise, privilege escalation, lateral movement and data exfiltration
• Correlate logs and events across SIEM (e.g. IBM QRadar), EDR/XDR, email security, firewalls and Active Directory
• Support containment actions such as endpoint isolation, blocking malicious IPs/domains and disabling compromised accounts
• Collect, preserve and analyse digital evidence with proper documentation and chain of custody
• Perform root cause analysis and IOC analysis, and support threat hunting using threat intelligence and MITRE ATT&CK
• Coordinate with IT, Network, Infrastructure, Cloud and Application teams on containment, eradication, recovery and remediation
• Escalate critical and high-severity incidents to the SOC Manager and Head of Information Security Operations
• Help improve incident response playbooks, detection rules and SOAR automation, and prepare incident reports and maintain incident tickets
• Take part in security incident simulations and tabletop exercises

Required profile

• Bachelor's degree in Computer Science, Information Security, Cybersecurity or a related field
• Minimum 2-3 years of experience in SOC operations, incident response or cybersecurity operations, with hands-on L2 incident investigation
• Experience in a banking or regulated financial institution is preferred
• Relevant certifications such as CompTIA CySA+ and Security+ are preferred

Required skills

• Hands-on experience with SIEM platforms such as IBM QRadar
• EDR/XDR, endpoint investigation, Windows/Linux logs and network security monitoring
• Incident response lifecycle, malware analysis, phishing investigation, threat hunting and digital forensics
• Working knowledge of MITRE ATT&CK, TCP/IP, DNS, HTTP/S, Active Directory, firewalls and common attack techniques
• Awareness of SBP cybersecurity requirements, ISO/IEC 27001 and the bank's information security policies