Security Operations Center Analyst II (SOC Analyst II)

Job Description

Job Description

Who We Are

At Old Second, you're first! For more than 150 years, Old Second has consistently put businesses and individuals throughout the Chicago area first, and we're only getting started.

With great employees we've grown from a single location in the back of a general store to 50 locations and over $6 billion dollars in assets. At Old Second we embrace values that foster an environment of community and growth. Recently, we've been voted a Forbes Best-In-State Bank for Illinois by our customers. Be a part of something big as we continue our growth story together!

Position Overview:

The Security Operations Center (SOC) Analyst supports the Information Security Program through security monitoring, incident response, threat intelligence, vulnerability management, user access governance, operational resilience activities, and administration of security technologies. The Analyst assists in protecting the confidentiality, integrity, and availability of Bank information assets through analysis, investigation, reporting, and remediation of cybersecurity events.

The SOC Analyst partners with Information Technology, Fraud, Risk Management, Vendor Management, Legal/Compliance, and business units to investigate incidents, support regulatory and audit activities, maintain operational readiness, and continuously improve the Bank's cybersecurity posture. Responsibilities and ownership vary by position level.

Security Operations Center Analyst - All Levels

Provides first response support by analyzing alerts and gathering information about potential incidents or vulnerabilities.

• Conduct first-level triage of security events and incidents, including phishing attempts, malware detections, dark-web exposures, suspicious email activity, and security tool alerts.
• Investigate suspicious emails identified through email security systems or reported by employees.
• Administer Business Email Compromise (BEC) response activities, including quarantine actions, email release reviews, and coordination with Fraud and Information Technology teams.
• Assess, prioritize, document, and escalate security alerts generated by security monitoring technologies according to established procedures and incident response playbooks.
• Perform security event investigations utilizing SIEM, EDR, email security, threat intelligence, and other security monitoring platforms.
• Document findings, collect evidence, and maintain incident records throughout the Incident Response Lifecycle.
• Execute incident response procedures and playbooks for assigned events and assist with containment, eradication, and recovery activities.
• Create remediation tickets and monitor assigned corrective actions through completion.
• Monitor threat intelligence feeds, vulnerability disclosures, vendor security notifications, and emerging threats that may impact Bank operations.
• Monitor external indicators including spoofed websites, brand abuse, leaked credentials, compromised vendors, and supply-chain cyber events.
• Assist in the administration and maintenance of assigned Information Security technologies.
• Compile and prepare operational metrics and reports related to incidents, phishing activity, vulnerabilities, patch status, security awareness activities, and other Information Security indicators.
• Support user access review execution by collecting access materials, validating user and role information, identifying exceptions, and supporting remediation efforts.
• Participate in Business Continuity Planning and operational resilience activities, including tabletop exercises, vendor outage scenarios, disaster recovery testing support, and lessons-learned documentation.
• Participate in security reviews of new technologies and business solutions as assigned.
• Support the collection of evidence and documentation required for audits, examinations, compliance reviews, and risk assessments.
• Perform daily operational review activities and other Information Security monitoring tasks as assigned.

Additional Responsibilities for Security Operations Center Analyst – Level II

Provides second-level response support by analyzing complex security alerts, validating findings, coordinating escalations, and supporting containment, eradication, and recovery activities. The SOC Analyst II serves as a senior technical and operational security resource responsible for advanced investigations, SOC process improvement, security governance support, operational resilience activities, and continuous improvement of Security Operations processes. Responsibilities include, but are not limited to:

• Lead or coordinate advanced security investigations and support escalation decisions for complex incidents, vulnerabilities, and threat activity.
• Maintain, test, and improve incident response playbooks, runbooks, escalation procedures, and audit-ready evidence.
• Serve as department lead for assigned incident response events and manage post-incident reviews with management.
• Validate SOC metrics and provide management reporting related to phishing testing, security awareness training, incidents, vulnerabilities, and operational trends.
• Develop, maintain, and distribute internal security awareness materials.
• Conduct risk assessments to determine the impact, criticality, and remediation timelines for identified vulnerabilities.
• Develop the quarterly Information Security trends newsletter and use relevant current events to support tabletop exercise planning.
• Lead or coordinate assigned User Access Reviews, support Segregation of Duties and Password Complexity control assessments, maintain UAR evidence, and assist with audit-ready documentation and final review packages.
• Lead assigned BCP/tabletop scenarios for SOC-managed platforms and ensure playbooks, escalation paths, alternate monitoring methods, and recovery procedures remain current.

Minimum Requirements

Bachelor's degree in computer science, Engineering or Related Field (logic, philosophy, systemic theology or related discipline with ability to apply concepts to technology) and three or more years of experience in one or a combination of the following: information security, compliance, operational risk management (includes audit, legal, credit risk, market risk, or the management of a process or business with accountability for compliance or operational risk); or equivalent combination of education and experience.

• Relevant military experience, certification, or ability to clearly demonstrate competence through experience may substitute for education requirement.
• Four years of related experience may substitute for the education requirement.

Competencies:

• Strong problem-solving skills. Ideal candidate prefers to work on a series of short-duration complex problems (vs. a single problem over a long period.)
• Excellent written and verbal communication skills
• Strong project management, analytical skills and administrative skills
• Excellent organizational skills, ability to multitask and demonstrate flexibility.
• Demonstrates initiative and creativity in problem-solving; self-motivated/self-starter; works independently with minimal supervision; works well under pressure, develops strong relationships with subordinates, peers, and senior managers; demonstrates commitment and accountability.

Preferred, but not required

• Information Security Certifications or pursuing certifications such as CISSP, CISM, CISA, CISSP, GAIC, CompTIA Security + etc.

Location Details

This position is considered a hybrid role. With management approval, an incumbent may work a combination of remote and onsite work to perform the regular responsibilities of the role. Actual schedule requirements may vary based upon business needs.

Compensation & Benefits

Base pay: $69,100 - $90,000

Old Second is committed to fair and equitable pay practices. Pay is dependent upon the pay range and the incumbent's knowledge, skills and experience.

Benefits: How We Support You - Old Second

Thanks for considering Old Second!