About The Role

EVOCS is hiring SOC Analysts at Level 2 (L2) to extend a client's security monitoring coverage into North America evening, weekend and public holiday periods, working alongside the client's existing analysts.

You will work inside the client's established Security Operations Centre: their tooling, their runbooks, their severity criteria and their escalation paths. The job is to catch what matters, work it properly, and hand it over cleanly to the next shift.

This is a triage and investigation role, not an alert-routing role. You will be expected to form a view on what an alert actually means, and to defend that view with the evidence you gathered.

02 What You Will Do

- Monitor security alerts and telemetry across your shift in Adlumin (Security Information and Event Management, SIEM) and SentinelOne (Endpoint Detection and Response, EDR).
- Triage and carry out first-line investigation: validate the alert, enrich it, rule out false positives, and assess severity against the client's criteria.
- Escalate confirmed or suspected incidents through the client's escalation path, with the evidence gathered during triage attached, not simply the alert reference.
- Execute documented client runbooks within the authority those runbooks grant to an L2 analyst.
- Maintain case and ticket records in the client's system of record: actions taken, evidence and outcome for every alert handled.
- Produce a written shift report and a handover to the incoming analyst at the end of every shift, covering open investigations, escalations raised and anything carried forward.
- Join client shift-change and operational calls that fall within your scheduled shift.

Where the role stops Incident command, containment and remediation decisions, digital forensics, threat hunting,



detection engineering and platform tuning all remain with the client. You escalate; you do not decide. Being disciplined about that boundary matters more in this role than it would in an internal SOC. 03 What We Are Looking For

Essential

- Two to four (2-4) years in a Security Operations Centre, of which at least one (1) year at Level 2 performing genuine investigation rather than alert routing.
- Hands-on experience with a SIEM platform and an EDR platform. The specific products matter less
- than your investigative method.
- Working knowledge of the MITRE ATT&CK; framework, common attack patterns, and how to distinguish a real detection from noise.
- Disciplined case documentation, and written English solid enough that your handover is usable by someone who was not on your shift.
- Genuine willingness to work the unsocial shift pattern described below. This is the substance of the role, not an occasional request.
- Immediate availability, with no notice period to serve.

Desirable

- Direct experience with Adlumin or SentinelOne.
- CompTIA CySA+ or Security+, GIAC GCIA, or Microsoft SC-200.
- Exposure to data centre, critical infrastructure or operational technology environments.
- Experience working inside a client's SOC rather than your own employer's, including the professional judgement that comes with it.

04 Shift Pattern and Engagement Terms Five scheduled shifts per week of eight hours each, forty hours per week. Shifts cover North America evening, weekend and public holiday periods, which places them largely in the early-morning to midday India Standard Time (IST) window. Weekend and public holiday shifts are part of the roster, not exceptions to it. The roster is fixed before the engagement begins and held for its duration. It is agreed with the client in advance, and shifts are rostered in accordance with applicable working-time and public holiday law.

📌 SOC Analyst - Level 2 (Noida)
🏢 Evolution Cloud Services (EVOCS)
📍 Noida