SOC Analyst

About Xerox Holdings Corporation

For more than 100 years, Xerox has continually redefined the workplace experience. Harnessing our leadership position in office and production print technology, we’ve expanded into software and services to sustainably power the hybrid workplace of today and tomorrow. Today, Xerox is continuing its legacy of innovation to deliver client-centric and digitally-driven technology solutions and meet the needs of today’s global, distributed workforce. From the office to industrial environments, our differentiated business and technology offerings and financial services are essential workplace technology solutions that drive success for our clients. At Xerox, we make work, work. Learn more about us at

We are seeking a Security Operations Center (SOC) Analyst, Level 2 to serve as a key line of defense in protecting Xerox information systems. You will triage and investigate security alerts, correlate evidence across multiple telemetry sources, and drive timely resolution or escalation. This role leverages AI-assisted detection and investigation capabilities to accelerate analysis while maintaining strict independent validation against authoritative telemetry and established runbooks.

Purpose

Ensure the security and integrity of organizational information systems by proactively monitoring, detecting, and investigating security threats. By maintaining a vigilant and responsive security posture, the SOC Analyst helps protect sensitive data, supports business continuity, and improves detection and response outcomes. The analyst uses AI-assisted capabilities to accelerate triage and investigations, while independently validating model outputs against authoritative telemetry and established procedures.

Scope

As an L2 SOC Analyst you will primarily focus on deeper analysis of security alerts and incidents that require cross-source correlation, hypothesis-driven investigation, and risk-based decisioning (e.g., monitor vs contain). You will execute response actions that are pre-approved in playbooks, verify outcomes, and escalate exceptions (critical assets, high business impact, ambiguous root cause, or destructive/high-blast-radius actions) to senior SOC/Incident Response resources. You will produce investigation artifacts (timeline, evidence, and queries used) suitable for peer review and audit and contribute to continuous improvement through structured feedback to detection engineering.

Influence

As a member of Xerox Cyber Security (XCS), the SOC Analyst actively influences the security culture through operational rigor, clear documentation, and disciplined escalation. You will share investigation insights to improve detections, reduce recurring false positives, and strengthen the organization’s overall security posture. You will also participate in security awareness and end-user engagement activities as needed to reinforce secure behaviors and reporting practices.

Key Responsibilities

Incident Monitoring, Investigation, and Response

• Monitor and triage security alerts and events using security tools and technologies (e.g., SIEM, EDR/XDR, IAM/IdP telemetry, email security, cloud audit logs).
• Investigate medium-to-complex alerts to determine scope, impact, and likely root cause; build defensible incident narratives grounded in evidence.
• Perform cross-source correlation and create timelines across endpoint, identity, network, and cloud/SaaS telemetry to validate detections and identify related activity.
• Use hypothesis-driven investigation techniques: generate competing hypotheses, design targeted tests, and update conclusions as evidence changes.
• Make risk-based decisions aligned to runbooks (e.g., contain vs monitor); document rationale, confidence level, and next steps.

AI-Assisted Investigation and Verification

• Leverage AI-assisted investigation capabilities (e.g., summarization, enrichment, clustering, prioritization) to accelerate triage while never accepting model outputs at face value; independently validate AI conclusions against authoritative telemetry before acting.
• Translate 'why flagged' signals into evidence-based explanations suitable for peer review; identify and document inconsistencies, hallucinations, or missing context in AI outputs.
• Execute response actions that are pre-approved in playbooks (e.g., account containment requests, IOC blocking per procedure); verify outcomes and document success/failure states.
• Escalate cases with complete context (timeline, evidence, scope/impact, actions taken, recommended next steps) when severity, ambiguity, or business impact warrants senior involvement.

Documentation, Communication, and Automation Safety

• Document investigations in the case management system, including queries used, evidence excerpts, timeline, decisions, actions taken, residual risk, and handoff notes.
• Provide structured feedback to detection engineering/ML stakeholders (TP/FP label and rationale, telemetry gaps, tuning recommendations) to improve alert fidelity.
• Maintain up-to-date knowledge of cybersecurity threats, attacker techniques, and detection best practices.

Basic Qualifications

• Bachelor's degree in computer science, Information Technology, or a related field (or equivalent practical experience).
• 2+ years of experience in a Security Operations Center, security monitoring, or incident triage/investigation role (Level 2 or equivalent).
• Applied proficiency and experience investigating alerts using SIEM queries/pivots and one or more of the following: EDR/XDR, IAM/IdP telemetry, cloud audit logs, email security, network telemetry.
• Strong analytical and problem-solving skills; ability to conduct hypothesis-driven investigations and produce defensible conclusions.
• Strong written and verbal communication skills; ability to collaborate effectively across teams and produce case notes suitable for peer review and audit.
• Ability to work in a fast-paced environment and manage multiple concurrent investigations, including clean handoffs across shifts.
• Working knowledge of AI-assisted security operations concepts and limitations (e.g., false positives, bias, hallucinations) with a bias toward validation and evidence.
• Discipline in sensitive data handling and data minimization when using AI tools (use approved platforms; redact/exclude unnecessary sensitive details).

Preferred Qualifications

• Certifications such as CompTIA Security+, CEH, GIAC (e.g., GCIH/GCIA/GMON), or similar.
• Experience with MITRE ATT&CK mapping and using it to structure investigations and communicate findings.
• Experience investigating cloud environments (AWS, Azure) and interpreting cloud/SaaS audit telemetry.
• Experience with scripting or query languages (e.g., Python, PowerShell, SQL) for basic enrichment, log parsing, and analysis.
• Experience executing SOAR playbooks with appropriate human-in-the-loop approvals and validation/rollback awareness.
• Experience contributing to detection improvements (writing/adjusting SIEM queries, proposing tuning changes, documenting repeatable triage logic).
• Experience using LLM/AI copilots for investigation acceleration with strict validation and data-handling practices.