Security Operations Center Analyst

Zencon Group Inc.; Columbia (SC); Remote; USD 55,000 - 96,000; Full time

Job summary

Zencon Group Inc. is seeking an experienced SOC Analyst – Incident Response to support security operations, threat detection, incident investigation, and response activities.

The role focuses on hands-on monitoring in SOC environments and creating clear incident artifacts. The right candidate has knowledge of MITRE ATT&CK, security dashboards, and reporting, with ability to collaborate across teams and communicate findings to stakeholders.

Qualifications

• 2+ years of experience in security monitoring and incident response.
• 2+ years of experience with MITRE ATT&CK.
• 2+ years of experience creating dashboards and security reports.
• Experience supporting large-scale SOC operations.
• Associate degree in IT or Information Security, or 4 years of related work experience.

Responsibilities

• Monitor and correlate security events across SIEM, EDR/XDR, IDS/IPS, and threat intelligence platforms to identify threats and potential security incidents.
• Investigate suspicious activities, phishing attempts, malware infections, and security alerts; determine root cause, scope, and impact.
• Perform incident analysis and elevate critical incidents to Tier 3 teams with detailed findings and supporting evidence.
• Create incident reports, investigation timelines, dashboards, and post-incident summaries.
• Apply the MITRE ATT&CK framework to analyze adversary TTPs.
• Recommend improvements to SOC playbooks, detection rules, alert thresholds, and correlation logic to reduce false positives.
• Support proactive threat hunting and integrate threat intelligence into security monitoring workflows.
• Collaborate with security engineering, SOC teams, and agency stakeholders to improve detection and response capabilities.
• Document operational procedures, runbooks, troubleshooting steps, and remediation recommendations.
• Communicate security findings and provide technical guidance to stakeholders.

Skills

Security monitoring

Incident response

MITRE ATT&CK framework

Dashboard/report creation

Threat hunting

Team collaboration

Communication of findings

Education

Associate degree in IT or Information Security

Tools

Palo Alto Cortex XSIAM/XDR

SIEM

EDR/XDR platforms

Job description

Duration: 12-Month Contract (Extension Possible)

Work Hours: Eastern Time (ET)

Interview: Virtual; potential second-round onsite interview

Job Description

We are seeking an experienced SOC Analyst – Incident Response to support security operations, threat detection, incident investigation, and response activities. The ideal candidate will have hands-on experience in Security Operations Center (SOC) environments, security monitoring, incident response, MITRE ATT&CK, and security dashboard creation and reporting.

Key Responsibilities

• Monitor and correlate security events across SIEM, EDR/XDR, IDS/IPS, and threat intelligence platforms to identify threats and potential security incidents.
• Investigate suspicious activities, phishing attempts, malware infections, and security alerts; determine root cause, scope, and impact.
• Perform incident analysis and elevate critical incidents to Tier 3 teams with detailed findings and supporting evidence.
• Create incident reports, investigation timelines, dashboards, and post-incident summaries.
• Apply the MITRE ATT&CK framework to analyze adversary tactics, techniques, and procedures (TTPs).
• Recommend improvements to SOC playbooks, detection rules, alert thresholds, and correlation logic to reduce false positives.
• Support proactive threat hunting and integrate threat intelligence into security monitoring workflows.
• Collaborate with security engineering, SOC teams, and agency stakeholders to improve detection and response capabilities.
• Document operational procedures, runbooks, troubleshooting steps, and remediation recommendations.
• Communicate security findings and provide technical guidance to stakeholders.

Required Qualifications

• At least 2 years of experience in security monitoring and incident response.
• At least 2 years of experience working with the MITRE ATT&CK framework.
• At least 2 years of experience creating dashboards and security reports.
• Experience supporting large-scale Security Operations Center (SOC) operations.
• Associate degree in Information Technology, Information Security, or a related field; alternatively, four years of relevant work experience may substitute for the degree.

Preferred Qualifications

• Hands-on experience with Palo Alto Cortex XSIAM/XDR.
• Knowledge of Linux, network administration, and network design.
• Experience administering firewalls, VPN technologies, Active Directory, and IDS/IPS solutions.
• Strong analytical, troubleshooting, documentation, and communication skills.
• Candidates located in Columbia, SC, or surrounding areas are strongly preferred.

Work Arrangement

This is a remote contract opportunity open to candidates nationwide who can work Eastern Time hours. Candidates must be willing to travel onsite when project needs require it. All travel-related expenses for onsite work are the responsibility of the candidate. Preference will be given to candidates who can support onsite project needs, particularly those local to South Carolina.