L2 Analyst (Tier 2 Analyst)

L2 analysts receive escalations from L1 and are responsible for more complex investigations that require broader context, querying across multiple data sources, and judgment calls about severity and scope. They often have a deeper understanding of attacker techniques and the organization's environment. L2 analysts may also be responsible for refining triage logic, improving playbooks, and feeding findings back to detection engineering.