VP Security Operations Center (SOC) Cyber Fraud Analyst – Level 2 (L2)

Description

This Level 2 SOC role covers round-the-clock watch over security events from endpoint, network, email, big data, web, and behavior anomaly tools, with first-pass triage and deeper analysis of what comes in.

The analyst documents findings clearly and hands cases to Incident Response, and also reviews the work of Level 1 analysts to check accuracy and procedure use.

The position maps to the NICE Workforce Framework's Defensive Cybersecurity Level 2 (PD-WRL-001) and Incident Response Level 2 (PD-WRL-003) roles.

It supports NIST CSF 2.0 Detect, Respond, and Identify functions and the NIST Incident Response Lifecycle stages of Detect, Respond, Mitigate, and Recover.

The work also involves designing detection content, leading the L1 team's development, and serving as a liaison between the SOC and other business units, all under enterprise data security policy.

Responsibilities

• Watch and triage alerts from SIEM, EDR, IDS/IPS, and enterprise fraud tools at all hours, acting as an analyst and as the main escalation point for complex incidents.
• Review Level 1 analysis, check it for accuracy, thoroughness, and procedure compliance, and re-analyze alerts when needed.
• Carry out fast containment for active fraud cases, such as locking compromised accounts, blocking fraudulent transactions, and cutting off attacker access at the application and network layers.
• Record all response steps, findings, and decisions in the case system so each case is complete enough to escalate or report on later.
• Write advanced SOC playbooks, standard operating procedures, and SOPs for complex cyber-fraud scenarios.
• Identify and roll out new AI and LLM use cases for deeper analysis, threat hunting, and incident response.
• Help maintain SOC governance, including documentation standards, escalation paths, and operational readiness.
• Lead training for L1 analysts and encourage continuous improvement across the team.
• Mentor and guide analysts, offering hands-on help with cyber-fraud analysis, data investigation, and triage.
• Run ongoing trend analysis to spot recurring threats and cyber-fraud patterns.
• Find likely malware activity through alerts, logs, telemetry, and artifacts, and escalate suspicious files according to procedure.
• Build new security use cases, run content reviews, draft Business Requirements Documents, and track use case results to catch over-alerting or weak content.
• Identify and triage service outages and log gaps, and address data visibility problems early.
• Join, lead, and organize cross-team meetings and calls with other business units.

Requirements

• Deep knowledge of cyber-enabled fraud methods, including account takeover, payment fraud, identity theft, and social engineering.
• Extensive hands-on experience handling complex fraud incidents in an enterprise SOC.
• Strong skill in SQL, Python, SAS, or R for querying and analyzing large datasets.
• Solid grasp of web application defense, including HTTP/S, DNS, and network traffic analysis across multi-tier enterprise systems.
• Experience with big data platforms such as Hadoop or Spark, plus RDBMS, ETL tools, data warehouses, and business intelligence platforms.
• Working knowledge of application security standards such as OWASP Top 10 and API security, and of risk assessment methods.
• Ability to correlate network, endpoint, and WAF logs with application and transaction logs to reconstruct a fraud event.
• Proven record of leading fraud response, writing up complex analysis, and mentoring junior analysts.
• Usually 6 to 10 years in cyber-fraud analysis, incident response, or data analytics within a security setting.
• Ability to work rotating 24x7 shifts.
• Bachelor's degree in Data Science, Computer Science, Information Systems, or a related field, or equivalent experience.
• Preferred: Experience with Web Application Firewalls and bot defense products.
• Preferred: Certifications such as Certified Fraud Examiner (CFE), GIAC Certified Incident Handler (GCIH), or data analytics or machine learning credentials.
• Preferred: Experience building dashboards and reports on fraud trends with tools such as Tableau or Power BI.
• Preferred: Experience writing or tuning rules and models for fraud detection systems.
• Preferred: Experience with scripting and automation, such as Python or PowerShell, to automate response tasks.

Conditions

Full-time position based in Irving, Texas, United States.

Salary range is $125,760.00 - $188,640.00.

Posting closes Nov 05, 2026.

Hiring decisions are made by people. Automated tools, including AI, are used only to match skills to roles.

Benefits

• Possible discretionary and formulaic incentive and retention awards for eligible employees.
• Medical, dental, and vision coverage.
• 401(k) retirement plan.
• Life, accident, and disability insurance.
• Wellness programs.
• Paid vacation, paid sick leave, and paid holidays.
• Benefit offerings may vary by jurisdiction, job level, and hire date.