CSOC Operational Engineer - Level 2

The CSOC Operational Engineer - L evel 2 will perform advanced cybersecurity monitoring, analysis, and investigations to identify and resolve complex security incidents, threats and control issues. Provide technical guidance to Level 1 engineers, validate AI- and automation-supported findings and response actions, and coordinate with escalation specialists to ensure effective, timely and well-controlled incident resolution. In this role, you will: • Guide Level 1 engineers and the decision support system to ensure correct diagnosis and effective use of approved AI and automation. • Ensure timely resolution and fulfilment of escalated incidents, service requests and control issues within applicable SLAs. • Maintain clear, accurate and auditable documentation, operational logs and effective handovers for complex incidents, service requests and control decisions. • Monitor threat, vulnerability, service-health and control-performance information using approved analytical and automated capabilities; assess business and operational impact and initiate proportionate action. • Perform detailed analysis of cyber threats, incidents, control failures and identity-related risks; validate AI- or automation-assisted findings and recommend preventative or corrective actions. • Review operational triage and control-handling activities performed by Level 1 engineers or approved automation, ensuring accurate closure or escalation. • Create and maintain operational procedures, automation playbooks, knowledge-base content and approved automation workflows, incorporating lessons from incidents and service issues. Qualification To be considered for this role, you must meet the below requirements: • Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience. • GIAC Certified Incident Handler (GCIH) or equivalent certification. Knowledge/Skills: • Advanced knowledge of CSOC detection, monitoring, incident response and operational workflows. • Strong working knowledge of the enterprise security platforms used for detection and response, including their capabilities, data sources, workflows and limitations, to support effective monitoring, investigation and incident handling. • Knowledge of infrastructure, cloud, endpoint, server, operating-system and network security controls relevant to monitoring and response. • Knowledge of protocol, web-service and database security concepts and their relevance to security operations. • Practical knowledge of defence-in-depth, zero-trust and operational-resilience principles, including security queries, basic scripting and approved automation or AI decision-support systems. • Analyse security events and operational evidence to identify threats, determine impact and recommend appropriate action. • Triage and prioritise alerts and incidents according to risk, urgency and operational impact. • Make timely decisions within delegated authority and escalate incidents to the appropriate response or resolver team. • • Degree or Honours (12+3 or equivalent) in Information Technology and 3+ years of Cybersecurity Operations experience. • GIAC Certified Incident Handler (GCIH) or equivalent certification. Knowledge/Skills: • Advanced knowledge of CSOC detection, monitoring, incident response and operational workflows. • Strong working knowledge of the enterprise security platforms used for detection and response, including their capabilities, data sources, workflows and limitations, to support effective monitoring, investigation and incident handling. • Knowledge of infrastructure, cloud, endpoint, server, operating-system and network security controls relevant to monitoring and response. • Knowledge of protocol, web-service and database security concepts and their relevance to security operations. • Practical knowledge of defence-in-depth, zero-trust and operational-resilience principles, including security queries, basic scripting and approved automation or AI decision-support systems. • Analyse security events and operational evidence to identify threats, determine impact and recommend appropriate action. • Triage and prioritise alerts and incidents according to risk, urgency and operational impact. • Make timely decisions within delegated authority and escalate incidents to the appropriate response or resolver team. • Apply safe, responsible and governed use of approved AI and automation tools within the role, protecting sensitive data, applying human oversight, validating outputs and complying with applicable policies and controls. • Communicate security findings and operational updates clearly through accurate written and verbal reporting for technical and non-technical stakeholders.