Security Operations Analyst

JOB SUMMARY: The SOC Analyst is responsible for monitoring, detecting, investigating, and responding to cybersecurity threats across the organization's technology environment. This role serves as a frontline defender against cyber threats by analyzing security alerts, conducting incident investigations, and escalating security events as appropriate. The analyst works closely with IT, infrastructure, cloud, and application teams to protect organizational assets, maintain security monitoring capabilities, and strengthen the overall security posture.

JOB ROLES AND RESPONSIBILITIES:

Security Monitoring & Detection

* Monitor security events and alerts generated by SIEM, EDR, IDS/IPS, email security, cloud security, and other security tools.

* Analyze and triage security alerts to determine legitimacy, severity, and business impact.

* Identify indicators of compromise (IOCs), suspicious behavior, and emerging threats.

* Perform continuous threat monitoring and situational awareness activities.

Incident Response

* Investigate cybersecurity incidents including malware infections, phishing attacks, account compromises, insider threats, and unauthorized access attempts.

* Execute incident response procedures and playbooks.

* Document findings, actions taken, and lessons learned.

* Coordinate containment, eradication, and recovery activities with appropriate stakeholders.

* Escalate significant incidents according to established procedures.

Threat Hunting & Intelligence

* Utilize threat intelligence feeds to enrich investigations.

* Research emerging threats, vulnerabilities, and attack techniques.

* Develop and refine detection use cases based on threat intelligence and incident trends.

Security Operations

* Support vulnerability management efforts by validating findings and tracking remediation.

* Assist with security tool administration and tuning.

* Review and improve alerting logic to reduce false positives.

* Participate in security assessments and operational readiness activities.

* Support audit and compliance initiatives as required.

* And other duties as assigned.

Documentation & Reporting

* Maintain accurate incident records, investigation notes, and operational metrics.

* Prepare reports on security incidents, trends, and findings.

* Contribute to development and maintenance of standard operating procedures (SOPs).

* Provide security recommendations to business and technical stakeholders.

Collaboration

* Work closely with infrastructure, networking, cloud, and identity teams.

* Participate in on-call rotations and after-hours incident response activities when required.

* Support user awareness efforts through identification of phishing and social engineering trends.

REQUIREMENTS (Education, Experience, and Training):

* Bachelor's degree in Cybersecurity, Information Security, Information Technology, Computer Science, or related field; or equivalent combination of education and experience.

* 3+ years of cybersecurity, information security, IT operations, or SOC experience (Level I/II).

* Experience investigating security alerts and incidents.

* Familiarity with SIEM platforms and security monitoring tools.

* (Preferred) Security Information and Event Management (SIEM) platforms (Splunk)

* (Preferred) Endpoint Detection and Response (EDR) solutions (Crowdstrike)

* (Preferred) Reliaquest managed detection and response (MDR) and Servicenow experience

* Microsoft 365 and Azure security technologies

* Network security concepts and protocols

* Identity and Access Management (IAM)

* Windows, Linux, and cloud environments

* MITRE ATT&CK framework

* Incident response methodologies

* Strong troubleshooting and investigative abilities

* Ability to prioritize multiple security events in a fast-paced environment

* Excellent attention to detail

* Strong written and verbal communication skills

Preferred Qualifications:

* CompTIA Security+

* CompTIA CySA+

* GIAC Certified Incident Handler (GCIH)

* GIAC Security Essentials (GSEC)

* SSCP

* Certified Ethical Hacker (CEH)

* SC-200 Security Operations Analyst

* CISSP

* Experience with Splunk, Microsoft core infrastructure technologies (Entra/Active Directory, Sharepoint, Copilot, etc.), CrowdStrike, or similar platforms.

* Experience with SOAR and security automation technologies.

* Exposure to cloud security platforms (Azure, AWS, GCP).

* Knowledge of NIST Cybersecurity Framework and incident response best practices.

COMPENSATION:

The salary range for this position is $95K -105K. Specific offers take into account a candidate's education, experience and skills, as well as the candidate's work location and internal equity. This position is also eligible for health insurance, 401k and bonus opportunity.