Job Title: Officer SOC L2
Department: Information Security
Job Overview
To support and assist in the investigation, containment, and resolution of cybersecurity incidents escalated from SOC L1, helping to detect genuine threats, minimise business impact, and protect the bank’s information assets, in line with approved incident response procedures, SBP cybersecurity requirements, ISO/IEC 27001, and Raqami’s information security policies.
Key Responsibilities
- Assist in investigating and analysing security alerts escalated by SOC L1 to identify genuine threats and security incidents, under the guidance of senior SOC / incident response team members.
- Support in-depth investigation of cybersecurity incidents, including malware infections, phishing attacks, account compromise, unauthorized access, privilege escalation, lateral movement, and data exfiltration, and assist in assessing incident severity, scope, business impact, and potential exposure of the bank’s information assets.
- Assist in correlating security logs and events across SIEM (e.g., IBM QRadar), EDR/XDR, email security, firewalls, Active Directory, and other security platforms to support incident analysis.
- Support the execution of authorized incident containment actions, including endpoint isolation, blocking malicious IPs/domains, and disabling compromised accounts, in coordination with relevant teams, and assist in incident response activities in accordance with approved procedures and playbooks.
- Assist in collecting, preserving, and analysing digital evidence while maintaining proper documentation and chain of custody, where applicable.
- Support root cause analysis to identify the initial access vector, attacker activities, affected systems, and security control gaps, and assist in identifying and analysing indicators of compromise (IOCs), including malicious IP addresses, domains, URLs, file hashes, and suspicious processes.
- Assist in threat hunting activities using threat intelligence, SIEM queries, endpoint telemetry, and MITRE ATT&CK techniques to identify suspicious activities not detected by existing controls.
- Coordinate with IT, Network, Infrastructure, Cloud, and Application teams to support incident containment, eradication, recovery, and remediation, and assist in monitoring remediation activities and validating that identified threats have been contained and resolved.
- Escalate critical and high‑severity incidents to the SOC Manager and Head of Information Security Operations in accordance with established escalation procedures.
- Contribute to the development and improvement of incident response playbooks, detection rules, correlation logic, and investigation procedures in coordination with the SOC Manager, and support SOAR automation and continuous improvement of security monitoring and incident response capabilities.
- Assist in preparing incident reports documenting investigation findings, timelines, impact, root cause, containment actions, and recommendations, and maintain incident tickets, evidence, and response records in accordance with internal policies and regulatory requirements.
- Support compliance with applicable SBP cybersecurity requirements, ISO/IEC 27001, and the bank’s Information Security policies and procedures; participate in security incident simulations, tabletop exercises, and continuous improvement initiatives; and perform duties in a 24×7 SOC environment, including rotational shifts and incident response outside normal working hours, when required.
Experience & Qualification Required
- Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or a related field. Relevant certifications such as CompTIA CySA+ and Security+ will be preferred.
- Minimum 2-3 years of relevant experience in SOC operations, incident response, or cybersecurity operations, with hands‑on experience in L2 incident investigation. Experience in a banking or regulated financial institution is preferred.
Skills & Competencies
- Hands‑on experience with SIEM platforms such as IBM QRadar.
- Practical experience with EDR/XDR, endpoint investigation, email security, Windows/Linux logs, and network security monitoring.
- Strong understanding of the incident response lifecycle, malware analysis fundamentals, phishing investigation, threat hunting, and digital forensics.
- Working knowledge of MITRE ATT&CK, TCP/IP, DNS, Active Directory, authentication mechanisms, firewalls, and common attack techniques.
- Experience in incident containment, root cause analysis, IOC analysis, and coordination with technical teams for remediation.
- Awareness of SBP cybersecurity requirements, ISO/IEC 27001, and the bank’s Information Security policies and procedures.
Raqami Bank is an equal opportunity employer. We welcome applications from all qualified individuals, including Persons with Disabilities (PWDs), and are committed to fostering an inclusive workplace where everyone has the opportunity to succeed.
Last date to apply: November 13, 2026.
#J-18808-Ljbffr
