> Markdown version of [/jobs/ext/2599567-tier-1-soc-analyst](https://www.wearedevelopers.com/jobs/ext/2599567-tier-1-soc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Tier 1 - SOC Analyst - **Company:** VDA Labs, LLC - **Location:** United States (Remote available) - **Salary:** $41,600.0 - $52,000.0 - **Contract:** Permanent contract - **Skills:** Cyber Security, Python (Programming Language), Windows PowerShell, Kusto Query Language, Security Information and Event Management, Scripting, Mitre Att&ck, Falcon Platform, Microsoft Sentinel, Splunk, SentinelOne Expertise - **Published:** August 4, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=2fbfd93509838bf6 ## About the Role * Foundational understanding of networking and endpoint security - how systems talk, what normal looks like, and how attackers abuse both * Familiarity with MITRE ATT&CK and the Cyber Kill Chain * Strong written communication - you can explain a technical finding to a non-technical business owner without dumbing it down or drowning them * The judgment to know when something is off, and the persistence to keep digging * A reliable home internet connection and a private, quiet workspace suitable for handling sensitive client data * Willingness to work rotating shifts, including nights, weekends, and holidays * Ability to pass a background check How you got there is up to you. A cybersecurity degree, a Security+ or CySA+, a home lab, a help desk background, military experience, or a bootcamp plus real self-study all count. We care about what you can do, not which box you checked. Bonus points for: * Hands-on or coursework exposure to a SIEM - Securonix, Microsoft Sentinel, CrowdStrike, Splunk, or similar * Hands-on or coursework exposure to an EDR platform - SentinelOne, CrowdStrike, Huntress, Carbon Black, Defender, or similar * Certifications such as Security+, CySA+, BTL1, GCIH, or CEH * Scripting for repetitive work (PowerShell, Python, KQL) * Prior MSP or MSSP experience - you already know what juggling multiple client environments feels like ## Description * Monitor and triage. Work the alert queue across client environments during your shift in our 24x7x365 SOC - validating detections, separating true positives from noise, and pulling the thread when something looks wrong. * Investigate. Use MITRE ATT&CK and Cyber Kill Chain analysis to understand what an attacker was attempting, how far they got, and what else may have been touched. * Respond. Follow established playbooks to contain, remediate, or escalate - and know when the playbook doesn't cover what you're seeing. * Write it down clearly. Deliver investigation reports to clients through our service management system. Clear writing is a core skill here, not a nice-to-have. * Talk to clients. Stay engaged through the lifecycle of escalated investigations, including calls with client IT and leadership. * Hand off cleanly. Participate in shift handovers, team huddles, and internal reviews so nothing gets dropped between shifts. * Keep sharpening. Stay current on emerging vulnerabilities, threat actor tradecraft, and attack trends - on paid time, with training we sponsor. Your first 90 days * Days 1-30: Onboarding and tooling. You'll shadow experienced analysts, learn our detection stack and playbooks, and start working alerts with a senior analyst reviewing your calls. * Days 31-60: You're running your own queue during your shift, writing client-facing reports, and escalating with confidence. * Days 61-90: You're a full shift contributor - handling escalations independently, joining client calls, and starting to spot detection tuning opportunities., * Technical conversation with a senior SOC analyst - a discussion about how you think through an investigation, not a trivia quiz * Final conversation with SOC leadership * Offer We aim to move from application to offer in under three weeks and to give every candidate who reaches the technical conversation a real answer either way. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) - [Oops! Stories of supply chain shenanigans](https://www.wearedevelopers.com/videos/245-oops-stories-of-supply-chain-shenanigans) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)