CyberClan provides enterprise security, and human response to small and midsize enterprises and channel partners through comprehensive risk assessment services, 24/7/365 managed detection and response services, and lightning-fast breach response. Formerly known as Network Test Labs established in Canada and specializing in vulnerability assessments and penetration testing in the gaming industry, CyberClan has grown from three employees in 2006 in one market to over 75 employees with clients in nine countries and offices in the Australia, Canada, United Kingdom, and United States as a leading Managed Services Provider.

Our mission is to make the online world a safer and more secure place by delivering sophisticated cybersecurity solutions in a highly personalized — and human — way.

CyberClan is hiring a T2 SOC Analyst who will be responsible for investigating and responding to security incidents across client environments, leveraging SIEM, EDR, threat intelligence, and other security technologies to identify and contain threats. Acting as an escalation point for complex investigations, you will perform detailed analysis, validate indicators of compromise, support incident response activities, and help drive continuous improvements across detection and response capabilities. This role requires willingness to work shifts (including unsociable hours and bank holidays where these fall into your shift pattern) as part of a 24x7 team.

The successful candidate will work closely with the SOC Manager and the SOC Lead. The ideal candidate will have an energetic, can-do attitude and be comfortable working in a metrics-driven environment, delivering results and supporting team members.

Key Responsibilities

- Perform Tier 2 triage and investigation of escalated security alerts from SIEM, EDR/XDR, email security, identity, cloud, firewall, and other monitoring tools.
- Correlate events across multiple data sources to determine whether activity is benign, suspicious, or a confirmed security incident.
- Manage multiple concurrent investigations across diverse client environments while maintaining SLA commitments.
- Apply a working understanding of the MITRE ATT&CK; framework to describe observed tactics, techniques, and procedures.
- Conduct investigation and evidence gathering, including log analysis, endpoint review, basic forensic artefact analysis, IOC enrichment, and timeline development.
- Document investigation steps, findings, impact,



and recommended next actions clearly in the ticketing platform.
- Support proactive threat hunting activities through log analysis, hypothesis validation, and investigation of identified indicators.
- Leverage internal and external threat intelligence sources to enrich investigations, validate indicators, and provide contextual analysis.
- Provide clear and timely investigation updates to internal stakeholders and client stakeholders throughout the incident lifecycle.
- Provide operational oversight and guidance to Tier 1 analysts, ensuring alerts are investigated, documented, and escalated in accordance with SOC procedures and service level objectives.
- Escalate confirmed or suspected incidents to the SOC Lead and Incident Response teams in accordance with established procedures.
- Follow established playbooks, runbooks, SLAs, and escalation paths consistently.
- Contribute practical feedback to improve detection logic, playbooks, knowledge base articles, and SOC operating procedures.
- Maintain awareness of current threat activity and apply relevant context to daily investigations.
- Lead the investigation and coordination of high-priority (P1/P2) security incidents until handoff, containment, or resolution in accordance with incident response procedures.
- Perform structured investigations and root cause analysis to determine attack scope, impact, origin, and recommended response actions.
- Serve as a technical point of contact during investigations, translating complex security findings into transparent and actionable information for non-technical client stakeholders.

Skills, Knowledge and Experience:

- Minimum of a bachelor's degree in a relevant field (e.g., Computer Science, Information Technology, Cybersecurity) or equivalent work experience.
- 3+ years of experience working in a SOC, security operations, incident response, or security monitoring environment.
- Experience creating and executing searches, queries, and investigations within SIEM platforms.
- Strong understanding of SOC workflows, alert triage, incident escalation, and investigation documentation.




- Hands-on experience using SIEM and endpoint security tools to investigate security events.
- Demonstrated ability to assess risk, prioritize investigations, and make sound escalation decisions in fast-paced operational environments.
- Working knowledge of MITRE ATT&CK; and common attacker behaviors, including phishing, credential attacks, malware, lateral movement, and command-and-control activity.
- Ability to analyze logs from Windows, Linux, network, identity, email, cloud, and endpoint sources.
- Understanding of networking fundamentals, including TCP/IP, DNS, HTTP/S, firewalls, proxy logs, and packet capture concepts.
- Ability to follow documented processes, meet programmer SLAs, and escalate appropriately when risk or uncertainty remains.
- Explicit written communication skills for tickets, incident notes, and client-facing updates.
- Curious, analytical mindset with the ability to ask good questions, validate assumptions, and continue learning.

Preferred Skills and Experience

- Experience with tools such as Microsoft Sentinel, Splunk, QRadar, Defender XDR, CrowdStrike, Trend Vision One, Sentinel One, or similar platforms.
- Familiarity with KQL, SPL, Sigma, PowerShell, Python, or other query/scripting languages used in investigations.
- Exposure to basic digital forensics, malware triage, phishing analysis, or cloud security investigations.
- Relevant certification or equivalent experience, such as CompTIA Security+, CySA+, SC-200, BTL1, or GIAC security operations certifications.

Attributes:

- Excellent interpersonal & customer service skills
- Ability to communicate technical information to non-technical stakeholders
- Genuine enthusiasm and drive to work within cyber security
- Good written skills to write explanations of systems, regulations and or procedures
- Ability to identify and suggest continual improvement
- Good analytical and problem-solving skills
- Ability to adapt to organizational change, work unsupervised & under pressure
- Proven ability to manage varied workload

Job Type

Full-time

Location

100% Telecommuting

Must be authorized to work in the Australia

% of Travel Required

0-5%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

📌 SOC Tier II Analyst (Australia)
🏢 Cyberclan
📍 Australia