SOC Investigation Specialist Talent Network

Mercor; India; Remote; INR 3,881,000 - 9,055,000; Full time

Job summary

Mercor is seeking a remote SOC Investigation Specialist to review alerts, validate evidence, and perform end-to-end investigations using Splunk. You will pivot across logs, entities, and timelines while maintaining thorough documentation and ground-truth conclusions.

The role favors experienced analysts who can mentor others and uphold high investigation standards. As a fully remote, independent-contractor position, you will join Mercor’s global network of security professionals and contribute

Qualifications

• 3+ years hands-on SOC experience.
• Hands-on Splunk investigations and SPL queries.
• Experience with log analysis, timelines, and evidence correlation.
• Excellent written and verbal English communication.

Responsibilities

• Review and evaluate SOC alerts against predefined scenarios.
• Distinguish true positives from false positives based on evidence and context.
• Perform end-to-end investigations including log analysis, entity pivoting, and timeline reconstruction.
• Maintain clear documentation of investigative steps, assumptions, evidence, and conclusions.
• Collaborate with program leads and annotators to uphold high-quality investigations.

Skills

SOC analyst

Splunk experience

Investigation skills

English fluency

Documentation skills

Tools

Splunk

Job description

SOC Investigation Specialist Talent Network

Company: Mercor

Commitment: Talent network

Location: Remote

Referral Link: https://t.mercor.com/m9vUv

Location requirementsAlbaniaAustriaBelgiumBosnia and HerzegovinaBulgariaCroatiaCzech RepublicDenmarkEstoniaFinlandFranceGermanyGreeceHungaryIcelandIndiaIrelandItalyKosovoLatviaLiechtensteinLithuaniaLuxembourgMaltaMoldovaMonacoNetherlandsNorth MacedoniaNorwayPolandPortugalRomaniaSan MarinoSerbiaSlovakiaSloveniaSpainSwedenSwitzerlandUnited Kingdom

Responsibilities

• Review, monitor, and evaluate SOC alerts and investigation outputs based on predefined scenarios and criteria.


• Distinguish true positives from false positives by validating investigative evidence and alert context.


• Perform end-to-end security investigations when required, including log analysis, entity pivoting, timeline reconstruction, and evidence correlation.


• Assess the correctness, completeness, and quality of SOC investigations produced by automated or human workflows.


• Apply consistent investigative judgment while recognizing that multiple valid investigation paths may exist for the same alert.


• Make clear binary determinations (e.g., ACCEPT / PASS) while also producing detailed ground-truth investigations when required.


• Use Splunk extensively to pivot across logs, entities, and timelines, including reading and reasoning about SPL queries.


• Maintain clear and accurate documentation of investigative steps, assumptions, evidence, and conclusions.


• Collaborate with program leads and other expert annotators to uphold high-quality investigation and annotation standards.


• Mentor or support other analysts where applicable, particularly in long-term or lead annotator roles.

Requirements

• 3+ years of hands-on experience as a SOC analyst in a production SOC environment (Tier 2 or above strongly preferred).


• Strong understanding of alert triage, incident investigation workflows, and evidence-based decision-making under time constraints.


• Mandatory hands-on experience with Splunk, including:


• Conducting investigations using Splunk


• Reading, understanding, and reasoning about SPL queries


• Pivoting between logs, entities, and timelines


• Proven ability to evaluate SOC investigations and determine whether conclusions are valid, incomplete, or incorrect.


• Strong investigative judgment and comfort making decisive evaluations.


• Fluent English (written and spoken) with strong documentation and communication skills.

Nice to Have

• Experience with Endpoint Detection & Response (EDR) tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne.


• Experience analyzing cloud security logs and signals:


• AWS (CloudTrail, GuardDuty)


• Azure (Activity Log, Defender for Cloud)


• GCP (Cloud Audit Logs)


• Familiarity with Identity & Access Management platforms such as Okta Identity Cloud or Microsoft Entra ID (Azure AD).


• Experience with email security tools like Proofpoint or Mimecast.


• SOC leadership or mentoring experience.


• Basic scripting experience (Python or similar).


• Security certifications (optional): GCIA, GCIH, GCED, Splunk certifications, Security+, CCNA, or cloud security certifications.

Why Join

• Work on cutting-edge SOC automation and AI-driven investigation systems.


• Apply real-world SOC expertise to shape how future security teams investigate and respond to threats.


• Take ownership of high-impact investigative evaluations and ground-truth security cases.


• Collaborate with experienced SOC practitioners, security engineers, and AI teams.


• Join Mercor’s global network of vetted security professionals.

We consider all qualified applicants without regard to legally protected characteristics and provide reasonable accommodations upon request.

Contract and Payment Terms

You will be engaged as an independent contractor.
This is a fully remote role that can be completed on your own schedule.
Projects can be extended, shortened, or concluded early depending on needs and performance.

Your work at Mercor will not involve access to confidential or proprietary information from any employer, client, or institution.

Payments are weekly on Stripe or Wise based on services rendered.

Please note: We are unable to support H1-B or STEM OPT candidates at this time.

About Mercor

Mercor partners with leading AI labs and enterprises to train frontier models using human expertise. You will work on projects that focus on training and enhancing AI systems. You will be paid competitively, collaborate with leading researchers, and help shape the next generation of AI systems in your area of expertise.