About This Role
This remote position is for a SOC Analyst to join the IT department of a prominent full-service legal practice. The role involves overseeing security operations across endpoints, cloud systems, and identity infrastructure, serving as the central point of contact for cybersecurity. The analyst will collaborate with a Managed Security Service Provider (MSSP) and internal IT personnel to validate alerts, contain threats, drive tickets to closure, and strengthen security policies and controls.
Responsibilities
- Monitor, triage, and respond to security alerts generated by the MSSP, XDR platforms (including SentinelOne and Windows Defender), and additional security tools across endpoints, identity, and cloud systems
- Quickly validate security detections by distinguishing between false positives and true positives, assessing the scope of impact, and thoroughly documenting all supporting evidence
- Take full end-to-end ownership of security tickets by categorizing, prioritizing, escalating as needed, and driving issues to complete closure with clear timelines and detailed notes
- Coordinate threat containment measures with the internal IT team—such as isolating endpoints, executing account actions, and blocking malicious indicators—in alignment with established incident response procedures and severity guidelines
- Strengthen security configurations within Microsoft 365 and endpoint detection and response (EDR) environments
- Analyze trends across alerts and security incidents to recommend and implement approved policy and control adjustments that mitigate risk and reduce recurring alert noise, including tuning detection logic, tightening access controls, and updating security standards
- Maintain, refine, and update SOC playbooks and incident response documentation as new threat patterns emerge
- Prepare concise, decision-ready weekly and monthly security reports for the IT Director covering incident summaries (events, impact, and remediation), alert volumes and categories, response times, closure quality, control gaps, and recommended fixes
- Support ongoing continuous improvement initiatives focused on endpoint telemetry, security monitoring, and incident response workflows
Requirements
- 2+ years of hands-on professional experience in a SOC analyst, security monitoring, or incident response role
- Demonstrated experience triaging security alerts and managing tickets from initial detection through final resolution rather than solely monitoring dashboards
- Hands-on experience with Microsoft Defender, Microsoft Sentinel, and/or SentinelOne, alongside Microsoft 365 security administration
- Solid knowledge of SIEM, EDR, firewall, and network security technologies
- Practical understanding of endpoint detection and response (EDR) concepts and common cyberattack patterns
