Remote SOC Analyst: SIEM & Incident Response

Horizon3.ai; United States; Hybrid; USD 124,000 - 161,000; Full time

Benefits offered by this job

Health insurance

Equity participation

Hybrid & remote work

Parental leave

Job summary

Horizon3.ai is a remote cybersecurity company hiring a mid-level SOC Analyst to monitor, triage, and detect threats within a scalable cloud‑native SIEM environment. You’ll work on alert validation, threat detection tuning, and incident response across AWS, endpoints, and SaaS sources.

Ideal candidates have 3–6 years in SOC, hands‑on SIEM experience (Elastic preferred), and proficiency with KQL/Lucene/SPL, Python/Bash/PowerShell, and cloud security tools.

Qualifications

• 3–6 years in a SOC or security analyst role.
• Experience operating an enterprise SIEM (Elastic SIEM preferred) in a cloud environment.
• Hands-on experience with log analysis, security telemetry, and event correlation.

Responsibilities

• Monitor, detect, and respond to security events across enterprise environments using the SIEM.
• Triage, investigate, and validate alerts; escalate as needed with context.
• Tune and test detection rules to reduce false positives and improve fidelity.
• Develop dashboards and KPIs to demonstrate SIEM effectiveness.
• Contribute to incident response playbooks and SOAR automation.
• Participate in threat hunting and weekly/monthly threat trend reporting.
• Collaborate with peers and mentors to onboard junior analysts.

Skills

SOC Analyst experience

SIEM monitoring

Alert triage

Detection tuning

Incident response

MITRE ATT&CK

LLM tooling

Python/Bash/PowerShell

Cloud security basics

Education

Bachelor's degree in CS/Cybersecurity

Tools

Elastic SIEM

Splunk

Microsoft Sentinel

QRadar

Job description

Horizon3.ai is a remote cybersecurity company hiring a mid-level SOC Analyst to monitor, triage, and detect threats within a scalable cloud‑native SIEM environment. You’ll work on alert validation, threat detection tuning, and incident response across AWS, endpoints, and SaaS sources.

Ideal candidates have 3–6 years in SOC, hands‑on SIEM experience (Elastic preferred), and proficiency with KQL/Lucene/SPL, Python/Bash/PowerShell, and cloud security tools.