Security Operations Center Analyst

Charter Solutions; Minneapolis, Saint Paul (MN, MN); Hybrid; USD 70,000 - 100,000; Full time

Job summary

Charter Solutions is seeking a contract Security Operations Center (SOC) Analyst to monitor, investigate, and respond to security events across our client's systems. This hybrid role covers alert triage, remediation, threat hunting, phishing analysis, and security tool administration.

The candidate should have 2+ years in a SOC, with hands-on work on Defender XDR, Sentinel, Entra ID, Intune, CrowdStrike, NGSIEM, and Active Directory audits; strong collaboration and thorough incident

Qualifications

• Minimum 2 years in a SOC or similar security operations role.
• Experience with alert triage, remediation and after-action documentation.
• Hands-on with Defender XDR, Sentinel, Entra ID, Intune, CrowdStrike and NGSIEM.

Responsibilities

• Log, analyze, and remediate security alerts; document incidents and responses.
• Proactively hunt for IOCs and investigate anomalies and suspicious IP activity.
• Analyze phishing emails, including header analysis and spoofing indicators.
• Operate and monitor security tools such as Defender XDR, Sentinel, Entra ID, Intune, CrowdStrike, NGSIEM.
• Create, update, and transfer incident tickets in ServiceNow.
• Collaborate with Cybersecurity Team and IT staff; document findings thoroughly.

Skills

Alert triage

Remediation

Threat hunting

Phishing analysis

Security tools

Collaboration

Documentation

Tools

Microsoft Defender XDR

Microsoft Sentinel

Entra ID

Intune

CrowdStrike

NGSIEM

Active Directory auditing

ServiceNow

Job description

Security Operations Center (SOC) Analyst

Position Summary

Charter Solutions is seeking a contract Security Operations Center (SOC) Analyst to help monitor, investigate, and respond to security events across our client's systems. This role supports day-to-day SOC operations — alert triage and remediation, threat hunting, phishing email analysis, and security tool administration — while working closely with the Cybersecurity Team to strengthen the client's overall security posture. This is a hybrid position that may require occasional after-hours work during active incidents.

Key Responsibilities

• Alert Management – Log, analyze, and remediate security alerts; conduct after-action reviews and maintain clear documentation of incidents and response activities.
• Threat Hunting – Proactively hunt for indicators of compromise (IOCs), monitor industry threat alerts and advisories, and investigate anomalies and suspicious IP activity.
• Phishing & Email Analysis – Analyze suspicious and reported emails, including email header analysis, and identify spoofing and other phishing indicators.
• Security Tools – Operate and monitor the security tool stack, including Microsoft Defender XDR, Sentinel, Entra ID, and Intune; CrowdStrike endpoint protection and NGSIEM; and Active Directory audit tools.
• Ticketing – Create, update, and transfer incident tickets in ServiceNow to ensure timely tracking, escalation, and resolution.
• Collaboration & Documentation – Collaborate closely with the Cybersecurity Team and broader IT staff, communicating findings clearly and maintaining thorough documentation.

Required Skills & Qualifications

• Minimum of 2 years of experience in a SOC or similar security operations role.
• Experience with alert triage, remediation, and after-action documentation.
• Working knowledge of threat hunting: IOC analysis, industry threat intelligence, anomaly detection, and IP investigation.
• Demonstrated experience analyzing phishing emails, including header analysis and spoofing identification.
• Hands-on experience with Microsoft Defender XDR, Microsoft Sentinel, Entra ID, and Microsoft Intune.
• Hands-on experience with CrowdStrike (endpoint protection) and Next-Gen SIEM (NGSIEM).
• Experience performing Active Directory audits.
• Experience using ServiceNow to create, update, and transfer tickets.
• Strong collaboration and communication skills · sound problem-solving and judgment · high attention to detail · a continuous learner who stays current on the evolving threat landscape and security tooling.