SOC Analyst

About This Role

This Security Operations Center Analyst role focuses on initial triage and alert review for security events, conducting in-depth investigations, and performing threat analysis for a client that monitors a large global network. The position involves containing attacks and improving detection capabilities, working with a team across three SOC locations.

Responsibilities

• Investigate security alerts and suspicious activities from the client's security stack, third-party tools, and cloud platforms
• Perform detailed investigations into security alerts, attacker techniques, and identify emerging threats
• Correlate events from multiple security tools and data sources to determine risk, business impact, and required remediation actions
• Assist with developing and maintaining detection rules, use cases, playbooks, and response procedures
• Validate security events and reduce false positives through tuning and optimization of monitoring tools
• Assist with preparing post-event reports, executive summaries, and technical documentation
• Stay current on threat intelligence, attacker tactics, techniques, and procedures (TTPs), and emerging cybersecurity trends

Requirements

• At least 1 year of experience in a Security Operations Center, Incident Response, or Cybersecurity Analyst role
• Experience investigating security events across endpoint, network, and cloud platforms
• Strong understanding of cybersecurity frameworks such as NIST, MITRE ATT&CK, CIS Controls, and Cyber Kill Chain
• Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or LogRhythm
• Experience with endpoint detection and response (EDR) solutions such as Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or Carbon Black
• Knowledge of networking protocols, operating systems, authentication technologies, and cloud security concepts
• Strong analytical, troubleshooting, and problem-solving skills
• Excellent written and verbal communication skills (you will be on customer calls)
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field; equivalent experience may be considered

Nice to have:

• Security certifications such as Security+, CySA+, GCIH, GCIA, GCFA, SC-200, CISSP, or equivalent
• Experience with Microsoft security technologies including Defender XDR, Sentinel, Entra ID, and Microsoft 365 security solutions
• Experience with scripting or automation using PowerShell, Python, KQL, or similar languages
• Knowledge of digital forensics and incident response methodologies
• Experience supporting cloud environments such as Azure, AWS, or Google Cloud Platform