Hybrid SOC Analyst (Contract) – Threat Hunting & Incident Response

TriCom Technical Services; Saint Paul (MN); Hybrid; USD 70,000 - 110,000; Full time

Benefits offered by this job

Contract position

401(k) match

Paid time off

Paid holidays

Job summary

TriCom Technical Services seeks a Security Operations Center Analyst to support and enhance day-to-day cybersecurity operations. This role monitors, investigates, and responds to security events across enterprise systems while helping strengthen the organization’s overall security posture.

The ideal candidate has hands-on experience with security monitoring, incident response, threat hunting, phishing investigations, and modern security platforms including Microsoft Defender XDR, Sentinel, Entra

Qualifications

• Minimum 2+ years of experience in a Security Operations Center (SOC) or related cybersecurity role.
• Experience performing security alert triage, remediation, incident investigation, and after-action documentation.
• Working knowledge of threat hunting techniques including IOC analysis, threat intelligence review, anomaly detection, and suspicious IP investigations.
• Experience analyzing phishing emails including email header analysis and spoofing identification.
• Hands-on experience with Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Intune.
• Experience supporting CrowdStrike Endpoint protection and NGSIEM platforms.
• Experience conducting Active Directory security audits and investigations.
• Experience managing and updating incidents within ServiceNow.
• Strong analytical, problem-solving, and troubleshooting skills.
• Excellent written and verbal communication skills.
• Close attention to detail and ability to work effectively in a collaborative team environment.

Responsibilities

• Monitor, investigate, and remediate security alerts across enterprise environments.
• Perform proactive threat hunting to identify indicators of compromise and potential security risks.
• Analyze phishing emails and suspicious communications to identify threats and recommend remediation actions.
• Operate and monitor the organization's security tool stack including Microsoft Defender XDR, Sentinel, Entra ID, Intune, CrowdStrike, and Active Directory auditing solutions.
• Create, update, elevate, and track security incidents through ServiceNow.
• Conduct incident documentation, reporting, and after-action reviews.
• Collaborate with cybersecurity and IT teams to strengthen security controls and improve operational response processes.
• Stay current on cybersecurity trends, threat intelligence, and evolving attack techniques.

Skills

Incident response

Threat hunting

Phishing investigations

Security monitoring

Collaboration

Communication

Threat intelligence

Tools

Microsoft Defender XDR

Microsoft Sentinel

Microsoft Entra ID

Microsoft Intune

CrowdStrike

NGSIEM

ServiceNow

Active Directory auditing

Job description

TriCom Technical Services seeks a Security Operations Center Analyst to support and enhance day-to-day cybersecurity operations. This role monitors, investigates, and responds to security events across enterprise systems while helping strengthen the organization’s overall security posture.

The ideal candidate has hands-on experience with security monitoring, incident response, threat hunting, phishing investigations, and modern security platforms including Microsoft Defender XDR, Sentinel, Entra