AgileBlue is an AI-native Security Operations platform that detects, investigates, and auto-responds to cyber threats across cloud, network, and endpoint environments. Our platform combines Sapphire AI for automated detection with 24/7 human-led investigation, built for mid-market organizations and the MSPs that serve them.
AgileBlue is hiring L2 SOC Analysts to handle high severity investigations that go beyond standard playbook scope. You will build incident timelines from raw logs, write your own queries to follow an investigation wherever it leads, and handle complex cases that need a real investigative approach.
You will work alongside L1 analysts on shift, pick up cases they cannot resolve, and hand off the most complex situations to the senior analyst. The job requires independent judgment. Playbooks are a starting point, not a ceiling.
• Handle cases that exceed L1 scope, including complex and high-severity cases requiring open-ended investigation.
• Build incident timelines from raw logs without relying on a prescriptive playbook. Use playbooks as a reference, not a dependency.
• Investigate suspicious activity by forming hypotheses about attacker behavior based on TTPs, then testing them against available telemetry.
• Write security queries to explore beyond what the alert surface shows. Contain and disrupt threats where the situation calls for it.
• Analyze security breaches to identify root cause. Prioritize and document findings with enough detail for incident reporting and client communication.
• Communicate findings to clients through established channels with clear, accurate documentation. Surface vulnerabilities and patterns identified through daily case review.
• Execute pre-scoped threat hunts assigned by the senior analyst on shift. Document findings and escalate hits.
• Follow customer-specific playbooks and internal SOC procedures. Identify gaps and report them to senior analysts.
• 2 to 4+ years of SOC or security operations experience, or a strong L1 analyst with a demonstrated investigative track record.
• Hands-on experience building incident timelines from raw log sources without being handed a template.
• Active experience writing KQL, EQL, or equivalent query language in a real investigation context.
• Working knowledge of attacker TTPs across the MITRE ATT&CK framework.
• Familiarity with endpoint, network, identity, and cloud log sources and what normal looks like for each.
• Clear written communication under pressure. Clients read your case notes.
Full-Time Employment
Multiple shifts available across our 24/7 operation
Cleveland, OH OR remote within the United States
SOC Manager
Competitive base salary | 401k with company match | Unlimited PTO | Paid training and certification support | Clear, measurable path to advancement
Submit your resume and a brief cover letter to ***email_hidden*** with 'SOC Analyst L2' as the subject line. Describe a specific investigation where you had to go beyond the playbook. Tell us what you found and how you found it.
...A hospital a few hours outside Billings, MT is seeking a Travel Physical Therapist to join their team for a 13 or 26-week contract. Housing is provided!~ Pay: $70.00/hourly Travel Physical Therapist Opportunity: Full-time, 13 or 26-week contract...
...term customer relationships and cultivating a workplace where associates are supported empowered and valued. About the Role We are seeking a selfmotivated resultsdriven RETAIL SALES AND MERCHANDISING ASSOCIATE to join our this role you will contribute to a...
...quality care including primary, hospital, and specialty care, emergency services, and behavioral health. As a teaching hospital of Harvard... ...seeking a full-time board certified/board eligible Emergency Physician to join our exceptional team. The Cambridge Health Alliance...
Job Overview TLC Nursing Associates, Inc. is seeking an experienced Medical Laboratory Technician (MLT) for travel assignments in various healthcare facilities. The MLT will be responsible for performing laboratory tests, analyzing specimens, and ensuring accurate...
...may be extended, shortened, or adjusted depending on scope and performance Work will not involve access to confidential or proprietary information from any employer, client, or institution About the Platform This opportunity is available through 24-MAG LLC...