Security Operations Center Analyst

Motion Recruitment; Irving (TX); On-site; USD 120,000 - 180,000; Full time

Job summary

Motion Recruitment seeks a senior SOC Analyst III to lead investigations and incident response for high-impact security events. You will act as a technical authority within the SOC, guiding detection engineering, threat hunting, and mentoring junior analysts.

The role focuses on coordinating response across telemetry sources, building detections in Splunk ES, and mapping to MITRE ATT&CK, while communicating findings to leadership and stakeholders.

Qualifications

• Strong hands-on Splunk experience and Splunk coding, with developing or tuning searches and detections.
• Experience leading complex security incident investigations and response.
• Ability to correlate security data across multiple telemetry sources.

Responsibilities

• Lead or serve as incident commander for critical events (e.g., ransomware, data exfiltration, insider threats).
• Investigate endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact.
• Build incident timelines by correlating data across Splunk ES, Cortex, and other log sources.
• Direct containment, eradication and recovery actions; coordinate remediation with infrastructure and apps teams.
• Preserve forensic evidence and maintain chain-of-custody documentation.

Skills

Splunk ES

Incident response

Threat hunting

MITRE ATT&CK

Log correlation

Tools

Splunk ES

Palo Alto Cortex

Job description

We’re seeking a senior SOC Analyst III to lead investigations and response for complex, high-impact security incidents. This role will serve as a technical authority within the Security Operations Center, guiding incident response, advanced investigations, threat hunting, and detection engineering while mentoring junior analysts.

SOC Analyst III

Location: Irving, TX 75063

Duration: 12-month W-2 contract with benefits; strong possibility of extension

What you’ll do

• Lead or serve as incident commander for critical events, including ransomware, business email compromise, data exfiltration, and insider threats.
• Investigate endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact.
• Build incident timelines by correlating data across Splunk Enterprise Security (ES), Palo Alto Cortex, and other log sources.
• Assess severity and business impact, escalating incidents when required.
• Direct containment, eradication, and recovery actions, such as isolating hosts, disabling accounts, and blocking indicators of compromise.
• Coordinate remediation with infrastructure, identity, and application teams.
• Preserve forensic evidence and maintain chain-of-custody documentation.
• Produce incident reports and contribute to post-incident reviews.
• Develop and tune Splunk ES detections and correlation searches mapped to MITRE ATT&CK.
• Turn threat intelligence, IOCs, and TTPs into searches, watchlists, and detections.
• Lead hypothesis-driven threat hunts based on intelligence, coverage gaps, and environmental risks.
• Mentor Level I and II analysts and strengthen investigation and documentation practices.

Required experience

• Strong hands-on Splunk experience, including Splunk coding and developing or tuning searches and detections.
• Experience leading complex security incident investigations and response.
• Ability to correlate security data across multiple telemetry sources.
• Knowledge of threat hunting, incident documentation, and MITRE ATT&CK.