Remote CSOC Analyst: Incident Response & Detection

Remote; San Francisco (CA); Híbrido; USD 110.000 - 180.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Team-building programs

Company events

Descripción de la vacante

BTSE Group in San Francisco is seeking a CSOC Analyst with 3–4 years of security monitoring experience to join a lean security team working with MSSP and internal engineering to reduce risk by validating detections and writing playbooks.

You will own incidents end-to-end, tune SIEM rules, analyze logs from SIEM/EDR/WAF, and contribute to insider threat monitoring, with collaboration across stakeholders and potential exposure to cloud environments.

Formación

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field.
• 3–4 years in a SOC or security monitoring/detection engineering role.
• Hands-on with SIEM: rule development, detection validation, and alert triage.
• Experience writing queries in ES|QL, EQL, or KQL; case management experience.
• Python scripting for automation or log parsing.
• Knowledge of MITRE ATT&CK and cloud security fundamentals.
• Familiarity with incident response frameworks and playbooks.

Responsabilidades

• Triage, analyze, and escalate security alerts across SIEM, EDR/XDR, WAF, email security, and cloud logs.
• Own incidents end-to-end from triage to resolution and document outcomes.
• Develop, tune, and validate SIEM detection rules and run validation exercises.
• Translate threat intel and hunting queries into defined, actionable responses.
• Contribute to insider threat monitoring and UEBA concepts.
• Verify MSSP and internal tooling are correctly onboarded and functioning.
• Track CSOC performance metrics to drive improvements.
• Write and maintain playbooks, detection rationales, and operational docs.
• Collaborate with internal stakeholders and regional partners; Chinese language skills a plus.

Conocimientos

SOC operations

SIEM rule development

Query languages (ES|QL/EQL/KQL)

Python scripting

Incident response

MITRE ATT&CK knowledge

Cloud security (AWS/Azure/GCP)

Documentation writing

Communication skills

Educación

Bachelor's degree in Cybersecurity or related field

Herramientas

SIEM tools

Descripción del empleo

BTSE Group in San Francisco is seeking a CSOC Analyst with 3–4 years of security monitoring experience to join a lean security team working with MSSP and internal engineering to reduce risk by validating detections and writing playbooks.

You will own incidents end-to-end, tune SIEM rules, analyze logs from SIEM/EDR/WAF, and contribute to insider threat monitoring, with collaboration across stakeholders and potential exposure to cloud environments.