Sr. SOC Analyst

We are seeking a Senior SOC Analyst / L3 SOC Analyst to serve as a senior hands-on member of the Security Operations Center. This person will investigate and respond to complex security incidents while helping the organization move from a reactive security model toward a more proactive SOC.

The ideal candidate will have strong hands-on experience with Splunk, CrowdStrike, incident response, and threat hunting and be comfortable independently owning complex investigations. This person will also help strengthen detection capabilities, improve SOC processes and playbooks, reduce false positives, and identify opportunities for automation.

Day to Day

Monitor, triage, and investigate security alerts across the environment

Use Splunk to search, correlate, and analyze security logs during investigations

Investigate endpoint threats and suspicious behavior using CrowdStrike

Own complex incidents escalated beyond L1/L2

Determine the scope and impact of security incidents and coordinate containment and remediation

Conduct proactive threat hunting to identify activity that may not be captured by existing alerts

Investigate phishing, suspicious email activity, endpoint events, network activity, cloud activity, and firewall events

Identify false positives and opportunities to improve alert quality and detection

Improve SOC playbooks, SOPs, and incident-response processes

Identify opportunities to automate repetitive SOC workflows

Participate in the team’s on-call rotation (one week a month)

Partner with security and technology teams throughout investigations

Help mature the SOC toward a more proactive, threat-focused security operation

10+ years of experience in IT and/or cybersecurity

5+ years of hands-on Security Operations Center (SOC) experience

Strong Senior / L3 SOC Analyst experience

Strong hands-on incident response and security investigation experience

Strong Splunk experience for security investigations and log analysis

Strong hands-on CrowdStrike experience

Experience with threat hunting and proactively identifying suspicious activity

Experience investigating threats across endpoint, network, cloud, email, and firewall environments

Strong understanding of SIEM, EDR, NDR, and IDS/IPS technologies

Ability to independently own complex security incidents from investigation through containment and remediation

Experience improving SOC processes, alerting, playbooks, and incident-response procedures GCIH, GCFA, or GCIA certification

Check Point and/or Palo Alto firewall experience

Tines / SOAR experience

ExtraHop experience

Netskope experience

Microsoft Sentinel and/or Microsoft Defender experience

AWS or Azure security experience

Python, PowerShell, or Bash scripting experience

Experience with security automation

Splunk dashboarding or administration experience