Security Operations Center (SOC) Analyst - SIEM / Splunk

WINTrio LLC is seeking a Security Operations Center (SOC) Analyst with experience supporting Security Information and Event Management (SIEM) platforms, particularly Splunk, within Federal cybersecurity environments.

This role is responsible for monitoring security events, investigating alerts, supporting incident response activities, conducting threat analysis, and enhancing operational visibility across enterprise systems. The successful candidate will help protect Federal environments by identifying suspicious activity, responding to security incidents, supporting continuous monitoring initiatives, and improving detection capabilities across cloud, network, application, and endpoint environments.

The ideal candidate possesses strong analytical skills, experience working in a SOC or cybersecurity operations environment, and the ability to investigate and respond to security events in accordance with Federal cybersecurity requirements.

Job Responsibilities

• Monitor security alerts, events, and indicators using Splunk, SIEM dashboards, endpoint security platforms, network monitoring tools, and cloud security services.

• Triage, investigate, document, and escalate security incidents based on severity, risk, mission impact, and established procedures.

• Correlate security events across firewalls, endpoints, identity systems, vulnerability scanners, applications, and cloud platforms.

• Develop, maintain, and refine Splunk searches, alerts, dashboards, reports, and correlation rules.

• Support incident response activities, including containment, eradication, recovery, evidence collection, and after-action reporting.

• Analyze logs from Windows, Linux, Active Directory, Azure AD/Entra ID, cloud services, firewalls, IDS/IPS solutions, endpoint detection platforms, and enterprise applications.

• Support continuous monitoring, threat hunting, insider threat investigations, and suspicious activity detection efforts.

• Document incidents, findings, timelines, remediation actions, and lessons learned using ServiceNow, JIRA, or similar tracking systems.

• Support reporting activities aligned with Federal cybersecurity requirements, SLAs, compliance mandates, and incident response procedures.

• Assist with SOC process improvement initiatives, playbook development, detection engineering, and workflow automation efforts.

• Collaborate with cybersecurity, infrastructure, cloud, and application teams to strengthen organizational security posture.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience.

• Minimum three (3) years of experience supporting cybersecurity operations, SOC activities, incident response, threat monitoring, or SIEM administration.

• Hands-on experience using Splunk or comparable SIEM platforms.

• Strong understanding of incident response processes, threat detection methodologies, log analysis, and alert triage.

• Experience analyzing endpoint, network, identity, application, and cloud security logs.

• Familiarity with Federal cybersecurity requirements, continuous monitoring programs, and compliance reporting.

• Strong written and verbal communication skills.

• Strong analytical, investigative, and problem-solving abilities.

Technical Areas

Security Operations & Incident Response

• Security Event Monitoring

• Alert Triage

• Incident Investigation, * AWS Security Monitoring

• Azure Security Monitoring

• Identity Security Monitoring

• Network Security Monitoring

• Endpoint Security Monitoring

Tools & Platforms

SIEM Platforms

• Splunk Enterprise

• Splunk Enterprise Security

• ELK Stack

• Microsoft Sentinel

• IBM QRadar

Endpoint & EDR Platforms

• CrowdStrike

• Microsoft Defender

• Carbon Black

• Trellix

• SentinelOne

Network Security Tools

• Firewalls

• IDS/IPS Platforms

• VPN Monitoring

• NetFlow Analysis

• Wireshark

Identity & Access Security

• Active Directory

• Microsoft Entra ID (Azure AD)

• Privileged Access Monitoring

Cloud Security Monitoring

• AWS CloudTrail

• Amazon GuardDuty

• AWS CloudWatch

• Azure Monitor

• Microsoft Defender for Cloud

Incident Management & Collaboration

• ServiceNow

• JIRA

• SOAR Platforms

• Case Management Systems

Scripting & Automation

• Python

• PowerShell

• Bash

Preferred Certifications

• CompTIA Security+

• CompTIA CySA+

• Splunk Core Certified User

• Splunk Core Certified Power User

• Splunk Enterprise Security Certified Administrator

• GIAC Certified Incident Handler (GCIH)

• GIAC Security Essentials (GSEC)

• Certified Ethical Hacker (CEH)

• Microsoft Security Operations Analyst Associate

Preferred Qualifications

• Experience supporting Federal SOC, continuous monitoring, or incident response programs.

• Experience creating Splunk dashboards, alerts, correlation searches, and executive-level reporting.

• Experience supporting SOAR automation initiatives, threat hunting programs, or detection engineering activities.

• Experience supporting cloud-hosted or hybrid technology environments.

• Familiarity with NIST SP 800-53, NIST SP 800-61, FISMA, DHS CDM, and FedRAMP requirements.

• Experience supporting enterprise cybersecurity operations centers.

• Full-time position.

• Remote within the United States.

• Standard business hours Monday through Friday.

• Occasional travel may be required in support of customer meetings, incident response activities, and program requirements.

WINTrio Benefits

• Healthcare (Medical, Dental, and Vision)

• Flexible Spending Account (FSA) and Health Savings Account (HSA)

• 401(k) and Retirement Savings Plan

• Annual Bonus and Profit Sharing Opportunities

• Paid Time Off (PTO) and Vacation

• Employee Assistance Program (EAP)

• Life, Personal, and Voluntary Disability Insurance

Growth Opportunities

There is ample opportunity to grow in multiple dimensions, including cybersecurity operations, incident response, threat hunting, cloud security, detection engineering, security automation, cyber defense, and cybersecurity leadership. We are a completely employee-driven company, and our continued success is built on the talent, dedication, and innovation of our team members.