Security Operations Center Analyst SOC 3 100% Remote Direct Hire Fortune 100CO

Confidential; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

Confidential is seeking an experienced SOC 3 Analyst to join our Security Operations Center and lead advanced monitoring, detection, and incident response efforts. The role requires deep expertise with SIEM and EDR, threat intelligence, and security analytics to identify and mitigate complex threats.

You will mentor junior analysts, develop detection rules, and coordinate across IT and security teams to strengthen our security posture. Strong communication and incident leadership are essential.

Qualifications

• 5+ years in cybersecurity with SOC operations, incident response or threat detection.
• Strong understanding of security monitoring and incident handling.
• Hands-on experience with SIEM platforms (Splunk, Microsoft Sentinel, QRadar).
• Experience with EDR/XDR solutions (Defender, CrowdStrike, SentinelOne).
• Knowledge of Windows and Linux, networking, AD, and common attack techniques.
• Familiarity with MITRE ATT&CK and threat intelligence.

Responsibilities

• Monitor and analyze security alerts across SIEM, EDR, network, identity, cloud, and email security.
• Lead investigations into complex incidents and coordinate containment and remediation.
• Develop detection rules and alerting mechanisms.
• Conduct threat hunting using MITRE ATT&CK and threat intelligence.
• Mentor junior SOC analysts and contribute to playbooks and SOPs.
• Prepare incident reports and coordinate with stakeholders across IT and security teams.

Skills

SOC operations

Incident response

Threat detection

Threat hunting

Analytical

Documentation

Communication

Education

Bachelor's degree in Cybersecurity, IT, or CS

Tools

Splunk

Microsoft Sentinel

IBM QRadar

Microsoft Defender

CrowdStrike Falcon

SentinelOne

Job description

We are seeking an experienced SOC 3 Analyst to join our Security Operations Center (SOC) and lead advanced security monitoring, threat detection, incident response, and threat hunting activities. The SOC 3 Analyst serves as a senior technical resource responsible for investigating complex security incidents, identifying advanced threats, improving detection capabilities, and mentoring junior SOC analysts.

The ideal candidate has strong expertise in security information and event management (SIEM), endpoint detection and response (EDR), threat intelligence, incident response, and security analytics. This role works closely with SOC leadership, incident response teams, threat intelligence, vulnerability management, and IT infrastructure teams to strengthen the organization's security posture.

Key Responsibilities

1. Security Monitoring and Threat Detection

• Monitor and analyze security alerts across SIEM, EDR, network security, identity, cloud, and email security platforms.
• Investigate complex security events and distinguish genuine threats from false positives.
• Develop, tune, and optimize detection rules, correlation searches, and alerting mechanisms.
• Identify suspicious activity, anomalous behavior, and indicators of compromise (IOCs).
• Analyze security telemetry to identify potential attack patterns and emerging threats.

2. Incident Response and Investigation

• Lead investigations into high-severity and complex security incidents.
• Perform advanced analysis of malware, phishing, credential compromise, lateral movement, and potential data exfiltration.
• Coordinate containment, eradication, and recovery activities with relevant technical teams.
• Conduct root cause analysis and document incident timelines, findings, and remediation recommendations.
• Support incident response playbooks, escalation procedures, and post-incident reviews.
• Coordinate with internal stakeholders during security incidents and communicate technical findings clearly.

3. Threat Hunting and Threat Intelligence

• Conduct proactive threat hunting using threat intelligence, MITRE ATT&CK techniques, and behavioral analytics.
• Research emerging threats, attack campaigns, vulnerabilities, and adversary tactics.
• Map observed activity to the MITRE ATT&CK framework to identify detection gaps.
• Develop hypotheses and queries to uncover threats that may bypass existing security controls.
• Enrich investigations with threat intelligence, IOCs, and adversary TTPs.

4. Security Tooling and Detection Engineering

• Develop and maintain SIEM detection rules, dashboards, correlation logic, and investigation queries.
• Use EDR/XDR platforms to investigate endpoint activity, process execution, persistence, and suspicious behavior.
• Analyze network traffic, DNS logs, authentication events, firewall logs, and cloud audit logs.
• Identify opportunities to automate repetitive investigations and response activities using SOAR or scripting.
• Recommend improvements to logging, telemetry coverage, alert quality, and security monitoring capabilities.

5. Advanced Analysis and Technical Leadership

• Serve as a technical escalation point for SOC Level 1 and Level 2 analysts.
• Review complex investigations and validate incident severity, scope, and response actions.
• Mentor junior analysts and share knowledge through technical sessions and case reviews.
• Create and improve incident response procedures, investigation guides, and standard operating procedures.
• Support SOC process maturity, operational efficiency, and continuous improvement initiatives.

6. Reporting and Collaboration

• Prepare detailed incident reports, investigation summaries, and technical recommendations.
• Provide actionable insights to SOC management, incident response leadership, and relevant stakeholders.
• Collaborate with IT, cloud engineering, identity and access management, vulnerability management, and compliance teams.
• Support security assessments, audit requests, and evidence collection related to security incidents.
• Track recurring threats, detection gaps, and opportunities to reduce security risk.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience.
• Typically 5+ years of experience in cybersecurity, with substantial experience in SOC operations, incident response, or threat detection.
• Strong understanding of security monitoring, incident handling, digital forensics, and threat investigation methodologies.
• Hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, IBM QRadar, or equivalent.
• Experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike Falcon, SentinelOne, or equivalent.
• Knowledge of Windows and Linux operating systems, networking, authentication, Active Directory, and common attack techniques.
• Familiarity with MITRE ATT&CK, the Cyber Kill Chain, IOC analysis, and threat intelligence.
• Ability to analyze logs, correlate events, investigate anomalies, and determine incident scope and impact.
• Strong analytical, troubleshooting, documentation, and communication skills.
• Experience creating or tuning detection rules and investigating complex security alerts.

Preferred Qualifications

• Relevant certifications such as GCIH, GCIA, GCFA, CISSP, Security+, CySA+, or equivalent.
• Experience with SOAR platforms and security automation.
• Proficiency in Python, PowerShell, Bash, SQL, SPL, KQL, or similar query and scripting languages.
• Experience investigating cloud security events in AWS, Microsoft Azure, or Google Cloud.
• Knowledge of identity security, zero-trust architectures, and privileged access management.
• Experience with malware analysis, digital forensics, and advanced persistent threat (APT) investigations.
• Familiarity with NIST Cybersecurity Framework, NIST incident response guidance, and ISO 27001.