L1 vs. L2 vs. L3 Support
New'Support engineer' can mean any of three levels, and the skills and pay differ a lot. L1 takes the first call or ticket and solves known issues from scripts. L2 investigates hands-on, with logs, SQL or server access. L3 is the specialists or developers who fix the root cause in the system or the code. Titles rarely say which level, so a 'Senior Support Engineer' may still be working at L1.
How to tell them apart on a resume
L1
First point of contact, ticket logging, password resets, known-issue scripts, escalation to L2, call and chat handling, high ticket volumes.
L2
Log analysis, SQL queries, server and application checks, workarounds, batch-job reruns, root-cause notes, escalation to L3 with evidence.
L3
Code fixes, configuration changes, permanent fixes for problem tickets, work with product engineering, writing the runbooks L1 and L2 follow.
The question that settles it
“When a ticket reached you, what could you do yourself: follow a known fix, investigate with logs and data, or change the code or system to fix the root cause?”
Each term in plain English
- L1/L2/L3 Support
How IT support is split by depth. L1 (the help desk or service desk) takes the first call and fixes common issues from a script; L2 handles problems that need hands-on technical work; L3 is the specialists or developers who fix the root cause in the system or code.
Ask “Which support level were you at? Tell me about a problem you fixed at the root so the tickets stopped coming back.”
- ITIL
The most widely used set of good practices for running IT services: how incidents are logged and resolved, how recurring problems are traced to a root cause, and how changes are approved before they reach live systems.
Ask “Give me an example of an incident that turned into a problem record. What was the root cause, and how was it fixed for good?”
- Incident Response
The structured process a team follows when something breaks in production — detecting, communicating, mitigating, and resolving the issue.
Ask “Tell me about the worst incident you were part of. What was your specific role in resolving it?”
Open the full tool for the other look-alike pairs, role profiles, and the JD decoder.