JOB DESCRIPTION

CyberClan provides enterprise security, and human response to small and midsize enterprises and channel partners through comprehensive risk assessment services, 24/7/365 managed detection and response services, and lightning-fast breach response. Formerly known as Network Test Labs established in Canada and specializing in vulnerability assessments and penetration testing in the gaming industry, CyberClan has grown from three employees in 2006 in one market to over 75 employees with clients in nine countries and offices in Australia, Canada, United Kingdom, and United States as a leading Managed Services Provider.

Our mission is to make the online world a safer and more secure place by delivering sophisticated cybersecurity solutions in a highly personalized — and human — way.

CyberClan is hiring a T2 SOC Analyst who will be responsible for investigating and responding to security incidents across client environments, leveraging SIEM, EDR, threat intelligence, and other security technologies to identify and contain threats. Acting as an escalation point for complex investigations, you will perform detailed analysis, validate indicators of compromise, support incident response activities, and help drive continuous improvements across detection and response capabilities. This role requires willingness to work shifts (including unsociable hours and bank holidays where these fall into your shift pattern) as part of a 24x7 team.

The successful candidate will work closely with the SOC Manager and the SOC Lead. The ideal candidate will have an energetic, can-do attitude and be comfortable working in a metrics-driven environment, delivering results and supporting team members.

Key Responsibilities

• Perform Tier 2 triage and investigation of escalated security alerts from SIEM, EDR/XDR, email security, identity, cloud, firewall, and other monitoring tools.
• Correlate events across multiple data sources to determine whether activity is benign, suspicious, or a confirmed security incident.
• Manage multiple concurrent investigations across diverse client environments while maintaining SLA commitments.
• Apply a working understanding of the MITRE ATT&CK framework to describe observed tactics, techniques, and procedures.
• Conduct investigation and evidence gathering, including log analysis, endpoint review, basic forensic artefact analysis, IOC enrichment, and timeline development.
• Document investigation steps, findings, impact, and recommended next actions clearly in the ticketing platform.
• Support proactive threat hunting activities through log analysis, hypothesis validation, and investigation of identified indicators.
• Leverage internal and external threat intelligence sources to enrich investigations, validate indicators, and provide contextual analysis.
• Provide clear and timely investigation updates to internal stakeholders and client stakeholders throughout the incident lifecycle.
• Provide operational oversight and guidance to Tier 1 analysts, ensuring alerts are investigated, documented, and escalated in accordance with SOC procedures and service level objectives.
• Escalate confirmed or suspected incidents to the SOC Lead and Incident Response teams in accordance with established procedures.
• Follow established playbooks, runbooks, SLAs, and escalation paths consistently.
• Contribute practical feedback to improve detection logic, playbooks, knowledge base articles, and SOC operating procedures.
• Maintain awareness of current threat activity and apply relevant context to daily investigations.
• Lead the investigation and coordination of high-priority (P1/P2) security incidents until handoff, containment, or resolution in accordance with incident response procedures.
• Perform structured investigations and root cause analysis to determine attack scope, impact, origin, and recommended response actions.
• Serve as a technical point of contact during investigations, translating complex security findings into clear and actionable information for non-technical client stakeholders.