VP Security Operations Center

Job ID: Posted:

Location:
Irving, Texas, United StatesSalary: $125,760.00
- $188,640.00Category: TechnologyCompany: CitiThe SOC Analyst (L2) performs continuous monitoring, initial triage, and in-depth analysis of security events across endpoint, network, email, big data, and web telemetry and behavior anomaly detection tools. This role provides high-quality documentation and escalation to Incident Response, while also performing Level 2 peer review analysis to ensure accuracy, thoroughness, and adherence to established procedures across the L1 team.
The L2 analyst leads education and training efforts for L1 analysts, serving as a formal mentor and technical lead. They are responsible for identifying and triaging service outages and log discrepancies, proactively addressing potential data visibility issues. The L2 analyst plays a critical role in designing and implementing new security use cases, conducting content reviews, drafting required Business Requirements Documents (BRDs), and monitoring use case performance to identify over-alerting or underperforming content. Furthermore, the L2 analyst attends, leads, and organizes cross-organizational communications and conference calls, acting as a key liaison between the SOC and other business units. The overall objective of this role is to ensure the execution of Information Security directives and activities in alignment with enterprise data security policy, while also driving strategic improvements, automation enablement, and mentorship within the SOC team.
Primary Framework AlignmentNICE Workforce Framework: Defensive Cybersecurity
- Level 2 (PD-WRL-001), Incident Response
- Level 2 (PD-WRL-003)NIST CSF 2.0 Functions: Detect, Respond, IdentifyNIST Incident Response Lifecycle: Detect, Respond, Mitigate, RecoverKey ResponsibilitiesPerform hands-on 24x7 monitoring and triage of alerts from SIEM, EDR, IDS/IPS, and enterprise fraud tools, serving as both an active analyst and the primary escalation point for complex incidents.
Perform Level 2 peer review of L1 analysis to ensure accuracy, thoroughness, and strict adherence to established investigative procedures, stepping in to re-analyze alerts when necessary.
Directly execute and coordinate rapid response and containment activities for active fraud incidents, including locking compromised accounts, blocking fraudulent transactions, and mitigating attacker access at the application and network layers.
Document all response actions, analytical findings, and decisions in the case management system to create a comprehensive, escalation-ready record for reporting and future analysis.
Design, author, and implement advanced SOC playbooks and standard operating procedures (SOPs) specifically for complex cyber-fraud incident scenarios.
Lead the identification and implementation of new use cases for AI/LLM tools to enhance advanced analysis, threat hunting, and incident response.
Support and enhance SOC governance activities including documentation standards, escalation paths, and operational readiness.
Lead education and training efforts for L1 analysts, fostering a culture of continuous improvement and operational excellence within the team.
Act as a formal mentor and technical lead, providing expert, hands-on guidance on cyber-fraud analysis, data interrogation, and incident triage.
Perform ongoing trend analysis and identification of recurring threat/cyber fraud patterns.
Identify potential malware-related activity through alert, log, telemetry, and artifact review and escalate suspected malicious artifacts in accordance with established procedures.
Required Knowledge, Skills & ExperienceAdvanced knowledge of cyber-enabled fraud TTPs, including