Security Operations Center Analyst

Insight Global; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

Insight Global is seeking a Senior SOC Analyst to join its Security Operations Center as a hands-on member responsible for investigating and responding to complex security incidents and helping move the organization toward a proactive SOC.

The ideal candidate will have strong hands-on experience with Splunk, CrowdStrike, incident response, and threat hunting, and will help mature detection capabilities, playbooks, and automation while managing complex investigations.

Qualifications

• 10+ years of IT and/or cybersecurity experience.
• 5+ years in hands-on SOC operations and incident response.
• Strong experience with Splunk for security investigations and log analysis.
• Hands-on CrowdStrike experience and threat hunting capabilities.

Responsibilities

• Monitor, triage, and investigate security alerts across the environment.
• Use Splunk to search, correlate, and analyze security logs during investigations.
• Investigate endpoint threats and suspicious behavior using CrowdStrike.
• Own complex incidents escalated beyond L1/L2 and coordinate containment and remediation.
• Conduct proactive threat hunting to identify activity outside existing alerts.
• Improve SOC playbooks, SOPs, and incident-response processes.

Skills

SOC analysis

Splunk

CrowdStrike

Incident response

Threat hunting

Log analysis

SIEM/EDR/IDS/IPS

Playbooks

Tools

Splunk

CrowdStrike

Job description

• 10+ years of experience in IT and/or cybersecurity
• 5+ years of hands-on Security Operations Center (SOC) experience
• Strong hands-on incident response and security investigation experience
• Strong Splunk experience for security investigations and log analysis
• Strong hands-on CrowdStrike experience
• Experience with threat hunting and proactively identifying suspicious activity
• Experience investigating threats across endpoint, network, cloud, email, and firewall environments
• Strong understanding of SIEM, EDR, NDR, and IDS/IPS technologies
• Ability to independently own complex security incidents from investigation through containment and remediation
• Experience improving SOC processes, alerting, playbooks, and incident-response procedures

Plusses

• GCIH, GCFA, or GCIA certification
• Check Point and/or Palo Alto firewall experience
• Microsoft Sentinel and/or Microsoft Defender experience
• AWS or Azure security experience
• Python, PowerShell, or Bash scripting experience
• Experience with security automation

Job Overview

We are seeking a Senior SOC Analyst / L3 SOC Analyst to serve as a senior hands-on member of the Security Operations Center. This person will investigate and respond to complex security incidents while helping the organization move from a reactive security model toward a more proactive SOC.

The ideal candidate will have strong hands-on experience with Splunk, CrowdStrike, incident response, and threat hunting and be comfortable independently owning complex investigations. This person will also help strengthen detection capabilities, improve SOC processes and playbooks, reduce false positives, and identify opportunities for automation.

Day to Day

• Monitor, triage, and investigate security alerts across the environment
• Use Splunk to search, correlate, and analyze security logs during investigations
• Investigate endpoint threats and suspicious behavior using CrowdStrike
• Own complex incidents escalated beyond L1/L2
• Determine the scope and impact of security incidents and coordinate containment and remediation
• Conduct proactive threat hunting to identify activity that may not be captured by existing alerts
• Investigate phishing, suspicious email activity, endpoint events, network activity, cloud activity, and firewall events
• Identify false positives and opportunities to improve alert quality and detection
• Improve SOC playbooks, SOPs, and incident-response processes
• Identify opportunities to automate repetitive SOC workflows
• Participate in the team's on-call rotation (one week a month)
• Partner with security and technology teams throughout investigations
• Help mature the SOC toward a more proactive, threat-focused security operation