L1 Security Analyst (SOC Analyst I)

Buchanan Technologies; Grapevine, Northern (TX, KY); Hybrid; USD 60,000 - 80,000; Full time

Job summary

Buchanan Technologies is seeking a motivated L1 Security Analyst to join our Security Operations Center (SOC) team in Grapevine, TX. This role supports multiple clients in a fast-paced managed services environment and is ideal for an early-career analyst who is detail-oriented, eager to learn, and capable of working shifts.

You will monitor security alerts, perform initial triage, document findings, and escalate incidents per runbooks.

Qualifications

• 0–2 years of experience in a SOC or related role.
• Basic understanding of cybersecurity concepts (phishing, malware, account compromise, endpoint and network security).
• Familiarity with Windows environments and basic networking concepts (TCP/IP, DNS, DHCP, VPNs, firewalls).
• Ability to follow documented procedures, runbooks, and escalation paths.
• Strong attention to detail, analytical thinking, and willingness to learn.
• Clear written and verbal communication skills.
• Ability to work in a shift-based SOC environment and support after-hours or on-call rotations as needed.
• Ability to pass a background investigation.

Responsibilities

• Monitor security alerts across multiple client environments using SOC tools and dashboards.
• Perform initial triage of security events and elevate confirmed or suspected issues to L2 analysts or team leads.
• Review logs, endpoint alerts, email security events, and identity-related activity for signs of suspicious behavior.
• Follow documented runbooks and standard operating procedures for common alert types.
• Assist with basic incident response activities under the guidance of senior SOC team members.
• Gather relevant information from SIEM, EDR, email security, firewall, VPN, and identity platforms.
• Clearly and accurately document alert details, investigation steps, findings, and escalation notes.
• Prepare shift handoffs and communicate open items to incoming analysts.
• Support client and internal communications with timely, factual updates through established channels.

Skills

Attention to detail

Analytical thinking

Communication skills

Willling to learn

Team collaboration

Tools

Microsoft Sentinel

Microsoft Defender

CrowdStrike

SentinelOne

PowerShell

Job description

L1 Security Analyst (SOC Analyst I) Security Analyst Grapevine , Texas 10428 Sep 30, 2026

L1 Security Analyst (SOC Analyst I)

About the Role

Buchanan Technologies is seeking a motivated L1 Security Analyst to join our growing Security Operations Center (SOC) team. This role supports multiple enterprise and mid-market clients across a global managed services environment and is ideal for an early-career analyst who is detail-oriented, eager to learn, and comfortable working in a fast-paced SOC.

You will monitor security alerts, perform initial triage, document findings, and elevate potential incidents according to established procedures. You will gain hands‑on exposure to SIEM, EDR, endpoint, email, identity, and cloud security tools while building a strong foundation in security operations.

Working closely with senior analysts, engineers, and team leads, you will help deliver high‑quality security outcomes for Buchanan clients.

Key Responsibilities

Security Monitoring & Alert Triage

Monitor security alerts across multiple client environments using SOC tools and dashboards.

Perform initial triage of security events and elevate confirmed or suspected issues to L2 analysts or team leads.

Review logs, endpoint alerts, email security events, and identity‑related activity for signs of suspicious behavior.

Follow documented runbooks and standard operating procedures for common alert types.

Assist with basic incident response activities under the guidance of senior SOC team members.

Gather relevant information from SIEM, EDR, email security, firewall, VPN, and identity platforms.

Clearly and accurately document alert details, investigation steps, findings, and escalation notes.

Prepare shift handoffs and communicate open items to incoming analysts.

Support client and internal communications with timely, factual updates through established channels.

Tooling & Process Support

Use Microsoft Sentinel and other SOC platforms to review alerts, logs, and incidents.

Run and modify basic KQL queries with guidance from senior analysts.

Identify recurring false positives and provide feedback for detection tuning.

Support SOAR playbooks and automation workflows by following documented procedures.

Threat Awareness & Continuous Learning

Stay current on common cyber threats, phishing techniques, malware trends, and vulnerability news.

Assist with indicators of compromise (IOC) checks and threat intelligence enrichment as directed.

Participate in knowledge‑sharing, training, and SOC process improvement activities.

Required Qualifications

0–2 years of experience in a SOC, IT support, security operations, help desk, network operations, or a related technical role.

Basic understanding of cybersecurity concepts, including phishing, malware, account compromise, endpoint security, and network security.

Familiarity with Windows environments and basic networking concepts, including TCP/IP, DNS, DHCP, VPNs, and firewalls.

Ability to follow documented procedures, runbooks, and escalation paths.

Strong attention to detail, analytical thinking, and willingness to learn.

Clear written and verbal communication skills.

Ability to work in a shift‑based SOC environment and support after‑hours or on‑call rotations as needed.

Ability to pass a background investigation.

Preferred Qualifications

CompTIA Security+, Network+, CySA+, Microsoft SC-900, SC-200, or a similar entry‑level security certification.

Exposure to SIEM or EDR tools such as Microsoft Sentinel, Microsoft Defender, CrowdStrike, SentinelOne, or similar platforms.

Basic familiarity with KQL, PowerShell, Python, or other scripting or query languages.

Experience with ticketing systems, case management, or managed services environments.

Familiarity with email security tools such as Proofpoint or Microsoft Defender for Office 365.

Exposure to identity and MFA solutions such as Microsoft Entra ID and Duo.

Interest in incident response, threat hunting, detection engineering, or security automation.

What Success Looks Like

Accurate and timely alert triage with appropriate escalation.

Clear, complete, and consistent case documentation.

Strong adherence to SOC runbooks and client procedures.

Steady growth in technical knowledge, tool usage, and investigative skills.

Positive collaboration with SOC peers, senior analysts, engineers, and team leads.