GSOC Analyst LVL 2 - Buenos Aires - Argentina
Intras Cloud Services is seeking a skilled and proactive GSOC Analyst Level 2 to serve as a senior escalation resource within our Global Security Operations Center. In this role, you will investigate complex security incidents, perform threat hunting, and drive response efforts across our Microsoft 365 and Azure cloud environments. You will mentor and support Level 1 analysts, ensuring timely and accurate escalation handling while continuously improving our security posture. This is a hands-on technical role for a cybersecurity professional with a strong cloud security foundation and experience leveraging AI-assisted tools to detect, analyze, and mitigate modern threats.
Key Responsibilities
Act as the primary escalation point for GSOC Level 1 analysts, triaging complex or high-severity alerts and guiding analysts through investigation workflows. Lead end-to-end incident response activities, including detection, containment, eradication, recovery, and post-incident review documentation. Conduct proactive threat hunting across Microsoft Sentinel, Defender XDR, and connected log sources to identify indicators of compromise (IOCs) and attacker TTPs. Develop, tune, and maintain SIEM detection rules, analytic queries (KQL), and alert logic to reduce false positives and improve signal fidelity. Monitor and investigate security events across Microsoft 365 environments, including Defender for Office 365, Purview, and the Microsoft Compliance Center. Administer and analyze alerts from Azure Security Center (Microsoft Defender for Cloud), Azure AD / Entra ID, and related Azure services. Leverage AI-assisted security tools — including Microsoft Copilot for Security — to accelerate threat analysis, investigation summaries, and recommended remediation steps. Perform vulnerability assessments and coordinate remediation efforts with IT and infrastructure teams, tracking findings to resolution. Author detailed incident reports, runbooks, and standard operating procedures (SOPs) to improve team documentation and knowledge transfer. Collaborate cross-functionally with IT, cloud engineering, and compliance teams to implement security controls and enforce policy. Support the continuous improvement of GSOC processes, playbooks, and automation workflows to increase team efficiency and response speed. Stay current on emerging threat intelligence, CVEs, attack campaigns, and adversary techniques relevant to cloud and Microsoft environments.
Requirements
Minimum 3–5 years of hands-on IT or cybersecurity experience, including at least 2 years in a security operations or incident response capacity. Demonstrated experience working within Microsoft 365 and Azure environments in a security-focused role. Prior experience as a GSOC / SOC Analyst Level 1 or equivalent, with a track record of handling escalated security events.
Preferred Qualifications
Experience with Microsoft Copilot for Security or other AI-driven security investigation tools. Familiarity with SOAR platforms and building automated playbooks in Microsoft Sentinel or Defender XDR. Knowledge of cloud-native security frameworks (e.g., MITRE ATT&CK, CIS Controls, NIST CSF). Prior experience in an MSSP or managed cloud security environment. Exposure to data loss prevention (DLP), insider threat monitoring, or eDiscovery workflows in Microsoft Purview. Scripting or automation experience (PowerShell, KQL, Python) for log analysis or tool integration. Soft Skills Strong analytical and critical thinking skills with the ability to assess complex, ambiguous situations under pressure. Clear and concise written and verbal communication — able to translate technical findings for both technical peers and non-technical stakeholders. Collaborative team player who actively supports Level 1 analysts through coaching and knowledge sharing. High degree of ownership and accountability — follows incidents through to resolution without drop-off. Adaptability and continuous learning mindset in a fast-evolving threat landscape. Strong attention to detail and disciplined documentation habits. Effective time management and prioritization across multiple concurrent incidents. Work Environment / Additional Information Location: Hybrid — availability to attend our offices at least once a week. Schedule: May include rotational shift coverage (including evenings, weekends, or holidays) to support 24/7 GSOC operations. On-Call: Periodic on-call rotation for high-severity incident escalation.