About the Role

As a Tier 2 MDR Analyst you own the deeper investigations — taking escalations from Tier 1, correlating activity across the kill chain, containing threats, and continuously tuning detections to cut noise and catch what automated tooling misses.

What You'll Do

• Investigate escalated incidents end-to-end, correlating signals across endpoint, identity, email, and cloud
• Execute containment and remediation actions with analyst approval and clear audit trails
• Tune detection rules and analytics to reduce false positives and improve fidelity
• Enrich cases with threat intelligence and map activity to MITRE ATT&CK
• Mentor Tier 1 analysts and contribute to playbook development
• Produce clear incident write-ups and client-facing summaries

What You'll Bring

• 2–4 years of hands-on SOC / incident analysis experience
• Proficiency with KQL and querying SIEM data (Sentinel/Defender preferred)
• Working knowledge of EDR platforms (Microsoft Defender, CrowdStrike, or similar)
• Understanding of incident response fundamentals and the attack lifecycle
• SC-200, GCIA, or comparable certification
• Strong analytical and communication skills

Nice to Have

• Scripting for automation (Python / PowerShell)
• Detection engineering experience
• Cloud security exposure (Azure / AWS / GCP)