# SOC L2 Specialist - (Saudi National Only)

> Müller`s Solutions · Riyadh, Saudi Arabia · — · Posted 2026-11-09

**Workplace:** on_site

## Description

### Role Summary

The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity.

### Key Responsibilities

-   Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning
-   Lead incident response: containment, eradication, recovery and root cause analysis
-   Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats
-   Tune SIEM correlation rules and use cases to reduce false positives
-   Run threat hunting based on threat intelligence and MITRE ATT&CK
-   Create and maintain incident response playbooks and SOAR workflows
-   Supervise and mentor L1 analysts, review their work, and manage shift handovers
-   Write incident reports and present findings to technical and management stakeholders
-   Report incidents in line with NCA requirements and SMC's escalation matrix
-   Track SOC KPIs such as MTTD, MTTR and SLA compliance.

## Requirements

-   Bachelor's degree in Cybersecurity, Computer Science, IT or related field
-   4–6 years in a SOC, with at least 2 years at L2 level
-   Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar)
-   Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms
-   Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols
-   Experience in an enterprise or managed SOC (MSSP) environment
-   Saudi national, fluent in Arabic and English
-   Willing to support on-call or shift rotation if required

### Preferred Certifications

GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification

## Apply

[Apply at Müller`s Solutions](https://apply.workable.com/mullers-solutions-1/j/BCA3DE1501/apply)

---
Powered by [Workable](https://www.workable.com)