SOC Analyst Level 2

SOC Analyst Level 2Location: Hybrid / Remote
Salary: Competitive
Contract: Permanent

Join Focus Group's Growing Cyber Security Team

Focus Group is looking for an experienced SOC Analyst Level 2 to join our expanding Security Operations Centre (SOC). This is an exciting opportunity for a cyber security professional looking to take the next step in their career, working with a wide range of customers and technologies while helping to strengthen and scale our managed security services.
As a key member of the SOC team, you'll investigate complex security incidents, act as a technical escalation point for junior analysts, and contribute to the continuous improvement of our detection capabilities, operational processes, and customer security outcomes.

Working across leading security platforms including RocketCyber, SaaS Alerts, and Bitdefender EDR, you'll play a critical role in identifying threats, coordinating responses, and helping to protect our customers from an ever-evolving cyber threat landscape.

Key Responsibilities

The Role

As a SOC Analyst Level 2, you'll be responsible for investigating and validating escalated alerts, correlating activity across multiple security platforms, and driving effective incident response activities. You'll also mentor Level 1 SOC Analysts, contribute to playbook development, improve detection logic, and support the ongoing evolution of our Security Operations Centre.

This role offers excellent progression opportunities for those looking to develop into Senior SOC, Detection Engineering, Threat Intelligence, or Incident Response roles.

Key Responsibilities

• Investigate and validate security alerts escalated from Level 1 analysts across RocketCyber, SaaS Alerts, and Bitdefender EDR platforms.
• Analyse endpoint, behavioural, and cloud identity events to identify malicious activity and signs of compromise.
• Perform root cause analysis on security incidents including phishing attacks, suspicious inbox rules, account compromise, and MFA-related threats.
• Correlate intelligence across multiple platforms to understand business impact and determine appropriate response actions.
• Coordinate response activities with internal engineering teams and customer stakeholders.
• Ensure investigations are fully documented with high-quality case notes and clear escalation paths.
• Support incident reviews and contribute to improvements in playbooks, detection logic, and tooling.
• Act as a technical escalation point and mentor for Level 1 SOC Analysts.
• Assist with customer onboarding into the SOC monitoring stack and support service alignment activities.
• Identify opportunities to improve alert quality, reduce false positives, and enhance SOC efficiency.
• Stay up to date with emerging cyber threats, attack techniques, and industry best practices.

Skills, Knowledge & Expertise

What We're Looking For

Essential Skills & Experience

• Minimum 2 years' experience within a SOC, MSSP, or cyber security operations environment.
• Hands-on experience investigating and triaging security alerts.
• Experience using security platforms such as RocketCyber, SaaS Alerts, or Bitdefender GravityZone EDR.
• Strong understanding of Microsoft 365 security threats, including suspicious logins, MFA attacks, and identity-based compromises.
• Knowledge of attacker techniques and the MITRE ATT&CK framework.
• Strong analytical and investigative skills with the ability to perform root cause analysis.
• Experience correlating security data across multiple sources and platforms.
• Excellent written and verbal communication skills.
• Ability to explain technical information to both technical and non-technical stakeholders.
• A collaborative mindset with a passion for mentoring and supporting colleagues.
• Strong attention to detail and commitment to high-quality documentation.
• Comfortable working independently within a remote-first environment.

Desirable Skills

• Industry certifications such as: 
  • Microsoft SC-200
  • CompTIA Security+
  • GCIH (GIAC Certified Incident Handler)
  • BTL1 (Blue Team Level 1)
• Experience tuning detection rules and security alerts.
• Exposure to vulnerability management and customer security reporting.
• Experience with scripting, APIs, or automation tools.
• Understanding of threat intelligence and indicators of compromise (IOCs).
• Knowledge of email security technologies and attack vectors.
• Experience analysing logs across multiple security platforms.
• Familiarity with Azure and Microsoft 365 security tooling.

Job Benefits

• Holiday Allowance - 24 days + bank holidays + birthday leave. 
• Hybrid working options - performance depending. 
• Enhanced maternity, paternity and adoption leave. 
• Paid volunteering day * regular charity events.
• Wider company benefits across health, financial wellbeing, Pension etc.

Internal job reference: Senior Associate