Security - Senior SOC Analyst (Level 3)

Tek Dallas Inc.; Irving (TX); On-site; USD 140,000 - 230,000; Full time

Job summary

Tek Dallas Inc. in Irving, TX seeks a senior Security Operations Center leader to direct investigation and response for critical security incidents.

You will act as technical lead or incident commander, perform advanced forensics and malware analysis, and drive proactive threat hunting while mentoring Level 1/2 analysts and aligning with Legal, Privacy, and IT to reduce risk. You will own the SOC detection lifecycle, validate detections, and design Cortex XSOAR workflows to improve telemetry and

Qualifications

• Bachelor's degree in Cybersecurity, CS, IT, or related field, or equivalent experience.
• 6+ years in cybersecurity with at least 4 years in SOC, IR, or threat hunting.
• Proven leadership in complex, high-severity incidents and incident command.
• Strong proficiency with SIEM/EDR and cloud attack techniques.

Responsibilities

• Lead complex and critical incident response with real-time decision making.
• Act as technical lead or incident commander for ransomware, BEC, data exfiltration, insider threats.
• Perform advanced forensic analysis on endpoints, memory, and cloud environments.
• Provide incident briefings to management and stakeholders.
• Lead post-incident reviews and remediation of root causes.
• Design and lead threat hunts based on intelligence and MITRE coverage.
• Develop detection engineering and Cortex XSOAR workflows.

Skills

Incident response leadership

Threat hunting

SOC automation

Python/PowerShell

SPL queries

Forensics & malware analysis

Windows/Linux/AD security

Mentoring analysts

On-call readiness

Executive communication

Education

Bachelor's degree or higher in Cybersecurity/CS/IT

Tools

SIEM (Splunk ES)

EDR (Palo Alto Cortex)

SOAR (Cortex XSOAR)

ServiceNow/Jira

Volatility memory forensics

Ghidra reverse engineering

KAPE/Velociraptor

Job description

Reports To: Manager, Cyber Defense Operations

Department: Information Security, Cyber Defense Operations

Location: Irving, TX (on-site, 7-Eleven Store Support Center)

Role Summary

You are the senior technical authority in the Security Operations Center, leading investigation and response for the organization's most complex and critical security incidents. You act as technical lead or incident commander during major events, perform advanced forensics and malware analysis, and lead proactive threat hunting to find threats that evade existing controls. You drive detection engineering and automation strategy, mentor Level 1 and Level 2 analysts, and partner with the Manager, Cyber Defense Operations, incident response leadership, and cross-functional teams such as Legal, Privacy, and IT to reduce risk and mature SOC capabilities.

Key Responsibilities

Lead complex and critical incident response

• Act as technical lead or incident commander for critical, high-impact incidents such as ransomware, business email compromise, data exfiltration, and insider threats
• Direct containment, eradication, and recovery across multiple teams, making real-time technical decisions within delegated authority
• Perform advanced forensic analysis of endpoints, memory, and cloud environments to establish root cause, attacker dwell time, and full scope of compromise
• Provide clear incident briefings and status updates to your Manager, IT Security leadership, and stakeholders such as Legal, Privacy, and Communications
• Lead post-incident reviews and drive remediation of root causes and control gaps to completion

Lead threat hunting and advanced analysis

• Design and lead hypothesis-driven threat hunts based on threat intelligence, MITRE ATT&CK coverage gaps, and environmental risk
• Perform static and dynamic malware analysis to extract IOCs, behaviors, and detection opportunities
• Analyze adversary TTPs targeting retail, payment, and franchise environments and translate findings into defensive actions
• Partner with the Threat Intelligence team to assess emerging threats and determine the organization's exposure

Drive detection engineering and automation

• Own the SOC detection lifecycle, including detection standards, peer review, and approval of new and tuned rules developed by Level 2 analysts
• Measure and improve detection coverage against MITRE ATT&CK, prioritizing gaps by threat relevance and business risk
• Design advanced Cortex XSOAR workflows for enrichment, containment, and case management
• Validate detection and response capabilities through purple team exercises, attack simulation, or adversary emulation
• Partner with security and infrastructure engineering to onboard new log sources and improve telemetry quality

Provide technical leadership and mentorship

• Serve as the senior escalation point for Level 1 and Level 2 analysts and as on-call technical lead for critical incidents
• Mentor and develop analysts through case reviews, training sessions, and structured skill development plans
• Author and maintain the SOC's incident response playbooks, SOPs, and escalation criteria
• Advise the SOC Manager on tooling, process improvements, staffing needs, and the SOC maturity roadmap
• Design and facilitate tabletop exercises and readiness drills for the SOC and cross-functional teams
• Support audit and compliance requests, such as PCI DSS, related to security monitoring and incident response

Tools and Technologies You Might Use

• SIEM: Splunk ES, including advanced SPL, data models, and risk-based alerting
• EDR: Palo Alto Cortex, including advanced hunting queries and live response
• SOAR and ticketing: Palo Alto Cortex XSOAR, ServiceNow, Jira
• Forensics and malware analysis: memory forensics (e.g., Volatility), artifact collection (e.g., KAPE, Velociraptor), malware sandboxes, reverse engineering tools (e.g., Ghidra)
• Network security: firewalls, IDS/IPS, proxy and DNS logs, full packet capture
• Cloud and identity: AWS, Azure, and Google Cloud audit logs, Active Directory / Entra ID
• Adversary emulation: Atomic Red Team, MITRE Caldera
• Frameworks: MITRE ATT&CK, NIST incident response lifecycle (SP 800-61), Diamond Model, Pyramid of Pain

Examples of Work and Technical Scope

• Serve as incident commander for a suspected ransomware intrusion, coordinating containment across IT, infrastructure, and leadership while preserving evidence
• Perform memory forensics on a compromised server to identify an in-memory implant and its command-and-control infrastructure
• Lead a threat hunt for credential dumping and lateral movement following a new threat intelligence report
• Reverse engineer a malicious attachment to extract IOCs and build behavior-based detections that remain effective when IOCs change
• Run a purple team exercise to validate detection f priority ATT&CK techniques and deliver a prioritized coverage gap report
• Investigate a potential business email compromise targeting finance, including mailbox rule analysis and OAuth application abuse
• Deliver an executive-ready incident summary covering root cause, business impact, and remediation recommendations

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience
• 6+ years of experience in cybersecurity, including at least 4 years in SOC, incident response, or threat hunting roles
• Demonstrated experience leading response to complex, high-severity incidents from detection through recovery
• Advanced proficiency with SIEM and EDR platforms, including complex query development (e.g., Splunk SPL) and detection engineering
• Deep knowledge of Windows, Linux, Active Directory, and cloud attack techniques, including persistence, privilege escalation, and lateral movement
• Hands-on experience with digital forensics (memory, disk, and log analysis) and malware analysis
• Proficiency in Python or PowerShell for automation, data analysis, and tooling
• Proven ability to mentor analysts and communicate technical findings to executives and non-technical stakeholders
• Ability to make sound decisions under pressure and act as technical lead during critical incident willingness to participate in on-call rotation as the senior escalation resource
• Experience with scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense Operation and Investigation
• Ability to develop, execute queries (e.g., SPL, XQL) and scripts (Python, PowerShell) using VS Code for log analysis, and automated simulation of security scenarios to validate detection rules
• Experience monitoring deployed detections for failures, query errors, and logic gaps; investigate detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.

Preferred Qualifications

• Industry certifications such as CISSP, GIAC GCFA, GCIH, GREM, GCTI, or OSCP
• Experience developing Cortex XSOAR content and implementing risk-based alerting in Splunk ES
• Experience responding to incidents in cloud environments (AWS, Azure, or Google Cloud) and Microsoft 365
• Experience planning or running purple team and adversary emulation exercises
• Experience in retail, payments, or PCI DSS-regulated environments, including familiarity with breach notification requirements
• Prior experience as an incident commander, SOC shift lead, or team lead