EVOCS OVERVIEW

EVOCS was founded with a clear purpose: to help businesses operate more effectively, solve complex challenges, and create opportunities for growth through practical expertise and technology solutions.

As an IT consulting firm, we work with our clients to understand their needs, identify the right technologies, and deliver solutions that improve performance and support their business objectives.

Today, EVOCS is a trusted technology partner to a growing number of organizations and industry leaders. Our team combines technical expertise, business understanding, and a commitment to quality to deliver effective solutions and build lasting client relationships based on responsiveness, consistency, and results.

EVOCS Overview

EVOCS's journey began with a mission to empower businesses with advisory expertise, empowered with ideal technologies to provide them with comprehensive solutions to grow and prosper.

Founded by a team of passionate experts, EVOCS has grown into a trusted partner to a growing number of leaders across their respective industries. Our roots in employee-managed operations reflect our commitment to quality, consistency, and client success.

If you enjoy working in a hyper-fast-growing company, are eager to be part of an agile team, and want to be part of our success story, then let's talk!

🎯 Role Overview

As a SOC Analyst L2, you will own escalated incidents from investigation through containment across FortiSIEM, FortiSOAR and Microsoft Defender XDR.

You will be responsible for finding root cause, driving response, sharpening detections and automation, and raising the bar for the L1 analysts who escalate to you.

🧩 What You Will Do

In this role, you will:

Investigation & Hunting

Investigate incidents escalated from L1: build the full timeline, determine scope and root cause, and confirm impact
Correlate endpoint, identity, email and network telemetry across Defender for Endpoint, Defender for Identity, Defender for Office 365 and FortiGate / FortiSIEM logs
Hunt proactively with Defender XDR advanced hunting (KQL) and FortiSIEM searches, mapped to MITRE ATT&CK

Incident Response

Lead containment and eradication — device isolation, account disablement, indicator blocking, malicious email purge — coordinating with IT and network teams
Write incident reports covering timeline, root cause, actions taken and recommendations; brief client stakeholders on high-severity events
Support major incident response and escalate to L3, IR or threat intel when required

Detection Engineering & Automation

Build, tune and retire FortiSIEM correlation rules, watchlists and reports to cut false positives and close detection gaps
Design and maintain FortiSOAR playbooks for enrichment, triage and automated response
Tune Defender policies, custom detections, suppression rules and alert thresholds

Mentorship & Continuous Improvement

Act as escalation point and mentor for L1 — review case quality, coach on investigations and update runbooks
Track SOC metrics (MTTD, MTTR, false-positive rate) and recommend process improvements

🧠 What You Will Bring

The top candidate will have the following skills:

3–5 years of hands-on experience as an analyst in a Security Operations Center (SOC), including at least 1–2 years at L2 or in incident response — required; IT support or NOC experience alone does not qualify
Experience with FortiSIEM (searches, correlation rules, parsers); FortiSOAR (case handling, playbook building); Microsoft Defender XDR and Defender for Endpoint; KQL advanced hunting; MITRE ATT&CK; incident containment
Deep networking and security knowledge: TCP/IP, DNS, firewalls (FortiGate a plus), proxies, VPN and packet analysis
Experience with Windows and Linux log analysis, Active Directory and Entra ID sign-in logs
A passion for turning recurring manual work into tuned detections and automated playbooks
An undying concern about detection gaps and threats that slip past the queue
Fluent in English (written and spoken) – bilingual or near-native level
Strong interpersonal and communication skills – this is a client-facing role that involves frequent interaction via email, calls, and meetings