Analyze alerts and pivot into log data to identify, escalate, communicate, and contain threats, focusing on the direct interface with the customer's in-house security organization.
Proactively conduct advanced threat hunting to seek out attacker presence in client environments.
Continuously learn customer environments to develop a deep understanding of a client’s business drivers and risk appetite.
Identify attack vectors, threat tactics, and attacker techniques, tailoring findings to meet specific client security needs, including driving the creation and tuning of alerts.
Review and validate the work of other analysts, serving as a primary liaison with the customer, and ensuring alignment with their security requirements.
Collaborate closely with internal teams to escalate and resolve issues, refine existing processes, and enhance Standard Operating Procedures (SOPs).
Create and maintain trusted and strategic advisor relationships with key MDR Security customer stakeholders, including developing success criteria and plans to support monthly and quarterly presentations of measurable trends and outcomes.
Engage directly with clients to understand, anticipate, and capture their needs, concerns, evolving objectives, and scope of operations.
Shift work and holiday work are required as part of a 24/7/365 SOC.
Requirements
Minimum of 4 years of experience with one or more of the following: Microsoft Defender, CrowdStrike, SentinelOne
Advanced knowledge of Intrusion Detection System (IDS) / Intrusion Prevention System (IPS) tools and applications
Demonstrated experience with 2 or 3 of the following: Packet Capture (PCAP) analysis using Wireshark; Familiarity with commercial or open source log or SIEM solutions; Event analysis, correlation, reporting and alerting; Reverse engineering malware and host-based analysis/detection; Service discovery tools such as nmap; Vulnerability scanning tools such as Nessus, Nexpose, and/or Qualys
Experience with system or network administration (Unix/Linux experience preferred)
Experience and knowledge of information security, IPv4/v6 networks, network devices, proxies, IDS/IPS, and monitoring tools
Degree in Computer Science, Engineering, or a related technical discipline or equivalent work experience
5+ years of experience in a SOC Analyst or SOC Advisory position
SEC+, CySA+, GSEC, GCIH, GCFA, or equivalent certifications/experience (preferred)
Strong understanding of cybersecurity fundamentals, threat landscapes, and attacker methodologies (e.g., TTPs, APTs)
Proven ability to conduct effective incident investigations, threat hunting, and response coordination.
Excellent analytical and critical thinking skills with a high attention to detail.
Ability to interpret complex data and communicate findings clearly to technical and non-technical audiences.
Experience collaborating with clients or stakeholders to align security priorities with business objectives
Skilled at mentoring junior analysts and reviewing the quality of their work.
Flexible and adaptable in fast-paced, high-pressure environments, including 24/7 SOC operations.
Benefits
Medical, dental, vision, disability, FSA, HSA, life and AD&D insurance
401(k) Plan
PTO, sick, holiday, & parental leave details are available
Applicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard skills
Microsoft DefenderCrowdStrikeSentinelOneIntrusion Detection System (IDS)Intrusion Prevention System (IPS)Packet Capture (PCAP) analysisWiresharkVulnerability scanning toolsUnixLinux
Soft skills
analytical skillscritical thinkingcommunication skillsmentoringcollaborationflexibilityadaptabilityattention to detailclient engagementincident investigation