SOC Analyst II (L2) Position Overview In partnership with AgileBlue, Shield Consulting is seeking a SOC Analyst II (L2) to investigate medium- and high-complexity security incidents within a 24x7 SOC operation. This position is ideal for security operations professionals looking to deepen their investigative capabilities by performing analyses that go beyond traditional operational playbooks. The professional will be responsible for conducting detailed investigations using raw logs, security telemetry, and advanced queries to identify malicious behavior, validate attack hypotheses, and support containment and incident response actions. The role requires technical autonomy, strong analytical skills, and independent decision-making in investigative scenarios. The analyst will work alongside L1 analysts, taking ownership of escalated cases and supporting the technical growth of the operation. They will also collaborate with senior analysts, security engineers, and support teams to strengthen Shield Consulting clients' environments and continuously improve managed security services. About Shield Consulting Shield Consulting is a global boutique consulting firm with operations in Brazil and Portugal, helping organizations strengthen their security and improve governance with greater confidence at every stage of their journey. About AgileBlue AgileBlue is an AI-driven Security Operations (SecOps) platform specializing in automated cyber threat detection, investigation, and response across cloud, endpoint, and network environments. Responsibilities Security Monitoring and Operations (80%) - Handle cases and incidents that exceed the operational scope of L1 analysts - Conduct medium- and high-complexity investigations in enterprise environments - Build incident timelines using raw logs and multiple telemetry sources - Perform security event analysis without relying exclusively on operational playbooks - Use playbooks as operational references while maintaining investigative autonomy - Investigate suspicious activities by formulating attacker behavior hypotheses based on TTPs and validating them through available telemetry - Create and execute security queries using KQL, EQL, or equivalent languages to deepen investigations - Analyze endpoint, network, identity, and cloud logs to identify anomalous behavior - Execute threat containment and mitigation actions when necessary - Identify the root cause of security incidents and events - Document analyses, evidence, and timelines in ticketing and incident management platforms - Communicate investigation findings to clients through established communication channels - Participate in operational handoffs between shifts and teams - Perform threat hunting activities previously defined by senior analysts Technical Support and Development (20%) - Support L1 analysts during investigations and operational escalations - Identify false-positive trends, operational gaps, and improvement opportunities - Contribute to the evolution of SOC playbooks, detection rules, and internal processes - Document relevant findings and support continuous improvement initiatives - Participate in technical training and ongoing professional development - Collaborate with senior analysts, security engineers, and support teams - Stay current on threats, vulnerabilities, TTPs, and security best practices Qualifications - Bachelor's degree in Information Security, Computer Science, Networking, Information Technology, or a related field - 2–4+ years of experience in SOC operations, security operations, Blue Team activities, or incident response - Proven experience investigating incidents using raw logs and multiple telemetry sources - Practical knowledge of KQL, EQL, or equivalent security investigation languages - Familiarity with the MITRE ATT&CK framework and attacker TTPs - Knowledge of endpoint, network, identity, and cloud log analysis - Experience with SIEM, EDR, and security monitoring tools - Ability to identify anomalous patterns and conduct investigations independently - Strong analytical and decision-making skills under pressure - Collaborative mindset and commitment to continuous learning - Strong verbal and written communication skills in Portuguese and English - Technical English proficiency for reading, investigating, and interpreting technical documentation Additional Information Employment Type: Full-time Work Model: Hybrid/Remote Compensation and Benefits The position has an approved budget, and the final offer will be aligned according to the candidate’s experience, seniority, and compensation expectations.