NOC Tier 2 Engineer

Business Unit:

Company Details:

Diagnose and Restore

Change Management

Coordination and Communication

Continuous Improvement

Inputs this role works from

Escalate to NOC Tier-3 / engineering when

Escalate to the Incident Commander (war room) when

Technical Depth

Monitoring and Observability Tools

Process Skills

Professional Skills

Preferred Skills

• Python for automation that spans several systems (e.g., one script that checks a service across Azure, AWS and on-premises).
• Splunk SPL basics.
• Network device CLI for reading switch, router and firewall state.
• Experience in a multi-customer or managed services NOC with contract-specific SLAs.
• Certifications (Preferred)
• ITIL 4 Foundation
• CCNA or CompTIA Network+
• Microsoft Certified: Azure Administrator Associate (AZ-104)
• AWS Certified SysOps Administrator – Associate
• CompTIA Security+
• Employee
• We are committed to creating an inclusive workplace and welcome applications from people of all backgrounds. We do not discriminate based on any protected characteristic under applicable law.

Certifications (Preferred)

Worker Type:

Qualifications

• Technical Depth
• Network: TCP/IP, OSI model, routing and switching, firewalls, VPN, DNS, DHCP, load balancers, network connectivity troubleshooting.
• Systems: Windows Server, Active Directory, Linux administration.
• Databases: Oracle and Microsoft SQL Server (performance, blocking, storage, job failures).
• Cloud: Microsoft Azure and AWS (compute, networking, identity, monitoring).
• Applications: Java-based applications, web and application servers, application logs.
• Working knowledge of the products and IoT devices for the contracts supported.
• Log analysis across firewalls, routers, switches, servers and applications.
• Monitoring and Observability Tools
• SolarWinds: NPM, NetFlow analysis, node and interface health.
• AppDynamics: transaction tracing and application performance analysis.
• Oracle Enterprise Manager: database and middleware performance analysis.
• Site24x7: synthetic monitoring and availability checks.
• Azure Monitor and AWS CloudWatch: metrics, alarms and log queries.
• PRTG Network Monitor and Nagios
• Ticketing systems (ServiceNow, Jira or similar) and Microsoft 365.
• All scripts kept in Git in an approved, peer-reviewed library.
• Read-only by default: diagnostic scripts never change anything; scripts that make changes need a change or ticket reference.
• No hard-coded credentials: credentials are pulled from a vault.
• Parameterized by contract and CI, safe to run twice, and logging what they did into the ticket.
• Process Skills
• ITIL incident, problem and change management, including emergency changes and rollbacks.
• Vendor escalation and management.
• Shift handover and incident documentation.
• Professional Skills
• Structured, analytical troubleshooting under pressure.
• Clear written and verbal technical updates for both technical and customer audiences.
• Attention to detail, and the ability to manage several incidents at once.

Responsibilities

• Take escalated tickets from Tier-1 and troubleshoot across network, compute, OS, database, application and cloud layers.
• Restore service through fixes, failover, scaling, or rolling back a bad change, within contract SLAs.
• Identify the likely root cause and record it, with resolution notes, in the ticket.
• Raise and implement emergency changes needed to restore service.
• Roll back changes that cause incidents, and check whether a recent change caused an incident.
• Execute critical out-of-band patches when requested by the SOC and validate service health after patching.
• Engage vendors (Oracle, Microsoft, AWS, ISPs and others) and internal infrastructure and application teams.
• Send status updates to customers and stakeholders on each contract's schedule during P1/P2 incidents.
• Collect and provide data (logs, configurations, flow data) to the SOC on request during security investigations.
• Raise problem records for recurring or unexplained issues.
• Tune alerts: remove noisy ones, adjust thresholds, and action false-positive tuning requests from Tier-1.
• Write and improve runbooks and automate common fixes so Tier-1 can resolve more issues at first contact.
• Coach Tier-1 analysts on troubleshooting and runbook use.
• Scope and Escalation Boundaries
• Escalated tickets from Tier-1 with triage evidence
• Monitoring data across all tools, CMDB/service maps per contract, change records and vendor contacts
• Requests from SOC Tier-2 for infrastructure data
• The root cause is outside standard operations (code defect, architecture limit, product/IoT firmware, capacity design).
• A fix needs a significant change or design decision.
• The issue is not resolved within the P1/P2 time limit (e.g., 1 hour of active work on a P1).
• There is a major incident: several contracts affected, a full customer outage, a likely SLA breach with penalties, or a possible security cause.