CSOC L2 Support Expert – Managed Detection & Response (SIRT)

CSOC L2 Support Expert – Managed Detection & Response (SIRT)

Ontario, Canada (Remote)

Full-Time

Job Summary:

As a CSOC L2 Support Expert, the candidate will provide advanced investigation and incident response within the client's Cyber Security Operations Center. The role correlates and investigates escalated alerts, leads containment guidance, documents incidents end to end and identifies SOAR automation to improve detection and response efficiency. Due to data residency requirements, this role must be delivered from the United States, Canada, UK or EU.

Role and Responsibilities:

• Continuously monitor the global environment using the client's security controls (SIEM, EDR, email, network and cloud telemetry).
• Correlate, triage and investigate escalated security incidents from L1.
• Follow and maintain incident-response runbooks and workflows.
• Provide advanced investigation, forensic, containment and mitigation guidance.
• Document attacks, scope, root cause and remediation for every incident.
• Coordinate incident-response stakeholders across IT, business units and third parties.
• Identify and propose SOAR automation opportunities to reduce manual effort.
• Produce incident reports, weekly status reports, monthly executive summaries, quarterly workshops and IRW documentation.
• Contribute to detection tuning feedback and threat-hunting activities.

Key Skills:

• At least 6+ years of experience in IT with 4+ years in SOC / incident response at L2 or above.
• Hands-on experience with SIEM platforms (Splunk, Microsoft Sentinel, QRadar or similar).
• Strong experience with EDR tools such as CrowdStrike Falcon or Microsoft Defender for Endpoint.
• Working knowledge of SOAR platforms (Splunk SOAR, Cortex XSOAR, Sentinel playbooks).
• Strong understanding of MITRE ATT&CK, cyber kill chain and incident response lifecycle (NIST 800-61).
• Experience with host and network forensics, log analysis and malware triage.
• Knowledge of Windows, Linux, Active Directory, cloud (AWS/Azure) and email security attack patterns.
• Scripting skills (Python, PowerShell, KQL/SPL) for investigation and automation.
• Experience in financial services or other regulated industries preferred.
• Must be eligible to work in the US, Canada, UK or EU.
• Excellent written communication for incident and executive reporting.
• High level of initiative and ownership mentality.

Education & Certifications: -

• B.Tech / B.E / M.Tech / MCA OR Any PG (Computer Science, IT, Information Security or related discipline).
• Technical Certifications are desired and a plus, such as: GIAC GCIH / GCIA / GCFA, CompTIA CySA+, Splunk Core Certified Power User, Microsoft SC-200, CrowdStrike CCFR.

About Solugenix

Solugenix is a leader in IT services, delivering cutting-edge technology solutions, exceptional talent, and managed services to global enterprises. With extensive expertise in highly regulated and complex industries, we are a trusted partner for integrating advanced technologies with streamlined processes. Our solutions drive growth, foster innovation, and ensure compliance providing clients with reliability and a strong competitive edge.

Recognized as a 2024 Top Workplace, Solugenix is proud of its inclusive culture and unwavering commitment to excellence. Our recent expansion, with new offices in the Dominican Republic, Jakarta, and the Philippines, underscores our growing global presence and ability to offer world-class technology solutions. Partnering with Solugenix means more than just business it means having a dedicated ally focused on your success in today's fast-evolving digital world.