Senior SOC Analyst

We are seeking a highly experienced Senior SOC Analyst (L3) who can lead complex security incident investigations, advanced threat hunting, digital forensics, malware analysis, and detection engineering.

The candidate will act as a technical lead or incident commander during critical security incidents, drive SOC automation and detection improvements, and mentor Level 1 and Level 2 analysts., * Lead investigation and response for critical security incidents, including ransomware, business email compromise, data exfiltration, and insider threats.

• Direct incident containment, eradication, and recovery activities.
• Perform advanced endpoint, memory, and cloud forensics to identify root causes and scope of compromise.
• Conduct proactive, hypothesis-driven threat hunting using threat intelligence and MITRE ATT&CK.
• Perform static and dynamic malware analysis and identify IOCs and attacker TTPs.
• Lead detection engineering, detection rule development, tuning, and validation.
• Develop and maintain Cortex XSOAR workflows for enrichment, containment, and case management.
• Conduct purple team exercises, attack simulations, and adversary emulation.
• Mentor L1/L2 SOC analysts and maintain incident response playbooks and SOPs.
• Communicate incident findings, business impact, and remediation recommendations to leadership.

• Strong experience with Splunk Enterprise Security (Splunk ES) and advanced SPL queries.
• Hands-on experience with Palo Alto Cortex XDR and Cortex XSOAR.
• Strong knowledge of Windows, Linux, Active Directory, and cloud security.
• Advanced digital forensics experience, including memory, disk, and log analysis.
• Malware analysis, reverse engineering, and threat hunting.
• Experience with Python, PowerShell, or XQL scripting and automation.
• Strong understanding of MITRE ATT&CK and the NIST Incident Response Lifecycle.
• Experience developing and validating security detection rules.
• Ability to investigate detection failures, query errors, and logic gaps.
• Experience conducting attack simulations and evaluating detection coverage., * Certifications such as CISSP, GIAC GCFA, GCIH, GREM, GCTI, or OSCP.
• Experience with Cortex XSOAR content development and risk-based alerting in Splunk ES.
• Cloud incident response experience across AWS, Azure, or Google Cloud.
• Experience with Microsoft 365 security investigations.
• Retail, payments, or PCI DSS-regulated environment experience.
• Previous experience as an Incident Commander, SOC Shift Lead, or Team Lead.

has context menu