Remote SOC Cyber Analyst: Threat Detection & Incident Response

Arcfield; Newport (RI); On-site; USD 64,000 - 112,000; Full time

Benefits offered by this job

Health Insurance

Life Insurance

Paid Time Off

Holiday Pay

Disability Insurance (Short/Long Term)

Retirement and Savings

Job summary

Arcfield is seeking a Security Operations Center professional in the United States to monitor and analyze security events with Splunk and Airlock Digital, investigate alerts, and coordinate incident response. The role emphasizes threat detection, analytics development, and cross-domain logs interpretation.

Candidates should have strong SIEM/XDR experience, AD and Windows Server knowledge, and a DoD clearance.

Qualifications

• BS 2-4 Years, MS 0-2 6+ Years experience in Security Operations Center processes and using SIEM and XDR tools
• Security Operations Center Analyst: Understand and respond to security detections in a SIEM adhering to Incident Response Processes. Ability to collect relevant information from network and host logs, correlate events together to develop incident timelines and deduce root cause. Collaborate with ISSOs and engineers/developers/admins to resolve security incidents
• Strong background in Security Compliance & Vulnerability Management. Familiarity with adhering to Cybersecurity Standard Operating Procedures, ability to review and update SOP documents for clarity and accuracy.
• Prior experience with deploying enterprise tools on Domain Computers, including Antivirus, endpoint protection, and vulnerability scanning
• Proficient in Active Directory (AD) & Domain Controller (DC) Administration
• Knowledge of Windows Server Administration, including Windows Server 2019/2022/2025 internals, registry, event logs, and system services
• Experience with Windows security baselines (CIS, DISA STIG)
• CompTIA Security+ CE
• Active Secret DoD Security Clearance required for this role

Responsibilities

• Monitor and analyze security events in Splunk and Airlock Digital. Analyst on Duty: Investigate alerts that are triggered in the Splunk Console to determine if a threat or normal activity is allowed in the environment.
• Provide threat detection and incident response to mitigate risks to the Network
• Security Detection Engineering: troubleshoot, improve and develop security detection analytics. able to determine detection gaps and draft analytics to correct them
• Experience in interpreting activity to determine what is malicious vs expected from a variety of sources such as Windows and Linux workstations and servers, Firewall, Switch, Router, Endpoint Security, Wireless Intrusion Detection, and other security and application logs Proficiency in scripting languages (PowerShell, Python, Bash, etc.)

Skills

Scripting languages

PowerShell

Python

Bash

Threat detection

Incident response

Education

Bachelor's degree

Master's degree

Tools

Splunk

Airlock Digital

SIEM

XDR

Job description

Arcfield is seeking a Security Operations Center professional in the United States to monitor and analyze security events with Splunk and Airlock Digital, investigate alerts, and coordinate incident response. The role emphasizes threat detection, analytics development, and cross-domain logs interpretation.

Candidates should have strong SIEM/XDR experience, AD and Windows Server knowledge, and a DoD clearance.