L2 Support Specialist / NOC-SOC Incident Handler

Professional Summary
Experienced L2 Support Specialist / Incident Handler with 2–4 years of hands-on experience in 24x7 NOC/SOC operations and Microsoft cloud environments. Skilled in in-depth investigation and containment of security incidents using the Microsoft Defender XDR suite (Defender for Endpoint, Office 365, Identity, Cloud Apps) and Microsoft Sentinel, as well as in Azure and Entra ID infrastructure troubleshooting. Acts as the escalation point for L1 analysts, coordinates containment with IT Operations, and drives incidents from validated alert through eradication and recovery within agreed SLAs. Strong written and verbal communication in Ukrainian and English, with a structured, evidence-based approach to incident documentation.

Project(s)
L2 Support Engineer will join an existing 24x7 support team that delivers managed NOC/SOC services to multiple clients, acting as the second-line escalation tier for both infrastructure and security incidents.

Key Skills & Competencies

• In-depth incident investigation across Microsoft Defender XDR and Microsoft Sentinel
• KQL query authoring for log review, correlation, and scoping of compromise
• Containment actions: device isolation, account disable, session revocation, MFA re-registration, token revocation, email Search & Purge
• Azure infrastructure troubleshooting: VMs, Azure Files/Storage, Azure Backup, App Services, Functions, Key Vault
• Networking: VNets, subnets, NSGs, UDRs, VPN gateways, ExpressRoute (troubleshooting level)
• Entra ID: Conditional Access, federation/SSO troubleshooting, RBAC adjustments
• Implementation of approved infrastructure changes (ARM/Bicep updates, configuration changes)
• SQL PaaS/IaaS troubleshooting (query performance triage, backup/restore validation)
• Coordination of containment activities with IT Operations and client stakeholders
• Reviewing and approving pending actions in the Defender Action Center (AIR semi-auto workflows)
• Building and refining incident timelines and evidence packages for L3 / post-incident review
• Mentoring L1 analysts; reviewing tickets for accuracy and completeness
• Bilingual: Ukrainian (native) and English (B2+ / C1)

Responsibilities Handled
Incident Investigation & Response (SOC)

• Take ownership of incidents escalated by L1 within agreed SLA timeframes
• Conduct in-depth investigation in Microsoft Defender XDR and Microsoft Sentinel: deep KQL queries, log review, cross-product correlation across Defender for Endpoint / Office 365 / Identity / Cloud Apps
• Identify probable cause, determine scope of compromise (blast radius), and document affected users, devices, and identities
• Execute containment actions using Defender tooling:
• Endpoint: isolate device, stop processes, collect investigation packages
• User account: force password reset, revoke sessions in Entra ID, force MFA re-registration, disable/block accounts as needed
• Email: Search & Purge / Purview eDiscovery to remove malicious messages
• Cloud apps: block app or revoke OAuth tokens via Defender for Cloud Apps
• Review pending actions in the Defender Action Center; approve, modify, or reject AIR-recommended remediations
• Coordinate eradication and recovery activities with IT Operations (patching, account restoration, system rebuilds)
• Monitor for recurrence during the post-incident observation window and confirm eradication via MDE Threat & Vulnerability Management
• Escalate Critical / Major incidents to L3 / Security Lead with a complete evidence package and incident timeline

Infrastructure Support (NOC)

• Investigate and resolve VM performance, Azure Files / Storage, and Azure Backup issues
• Troubleshoot networking issues (VNets, NSGs, UDRs, VPN, ExpressRoute) and PaaS service failures (App Services, Functions, Key Vault access)
• Implement approved configuration changes (ARM/Bicep, NSG rules, RBAC adjustments) within change-management process
• Validate SQL backup/restore operations and triage SQL performance issues
• Resolve Conditional Access / federation / SSO incidents in Entra ID

Client & Internal Coordination

• Serve as the technical escalation point for L1 analysts during shift handovers
• Communicate incident status, recommended actions, and timelines to clients using approved templates
• Coordinate with developers and L3 engineers on bug reproduction and complex root-cause analysis
• Participate in shift handovers, ensuring all open incidents have complete context

Documentation & Continuous Improvement

• Maintain a complete incident record in the ticketing system (timeline, evidence, actions, outcomes)
• Contribute to runbooks, playbooks, and the internal knowledge base
• Recommend SIEM rule tuning and detection improvements based on observed false positives and missed detections (implementation owned by L3)
• Support onboarding of new clients (Defender / Sentinel connector deployment, baseline configuration validation)

Requirements
Must have

• 2+ years of hands-on experience in a SOC, NOC, or IT support role with a security focus
• Working knowledge of Microsoft Defender XDR or Microsoft Sentinel (production experience, not just training)
• Basic KQL — able to write and modify queries for investigation and scoping
• Practical experience with Entra ID / Azure AD administration (users, groups, MFA, Conditional Access basics)
• Experience handling incidents end-to-end: triage → investigation → containment → documentation
• English B2+ (written and spoken); Ukrainian native or fluent
• Willingness to work in a 24x7 rotating shift model

Strong plus

• Microsoft Security Operations Analyst certification (SC-200)
• Hands-on experience with both Defender XDR and Sentinel
• Azure networking troubleshooting (VNets, NSGs, VPN, ExpressRoute)
• Experience with SOAR / Logic Apps / playbook authoring
• Prior MSSP or multi-tenant environment experience

Nice to have

• Microsoft Security, Compliance, and Identity Fundamentals (SC-900)
• Microsoft Azure Administrator Associate (AZ-104)
• Microsoft Azure Fundamentals (AZ-900)
• Microsoft 365 Fundamentals (MS-900)
• ITIL 4 Foundation
• Scripting experience (PowerShell, KQL advanced, Python basics)

Availability

• Shift pattern to be confirmed; rotation includes nights and weekends
• On-call rotation may be required as part of L2 escalation coverage

Originally posted on Himalayas