Senior SOC Analyst

Resolve Tech Solutions; Irving (TX); On-site; USD 140,000 - 200,000; Full time

Job summary

Resolve Tech Solutions is seeking an experienced cybersecurity leader to coordinate incident response for high-severity events, perform memory forensics, and drive threat hunting initiatives. The role includes mentoring analysts, developing detections, and delivering executive summaries detailing root cause, impact, and remediation.

Responsibilities include leading incident command during ransomware scenarios, validating detections via purple team exercises, and coordinating with IT leadership

Qualifications

• Bachelor's degree in Cybersecurity, CS, IT, or related field, or equivalent experience.
• 6+ years of experience in cybersecurity, including at least 4 years in SOC, incident response, or threat hunting roles.
• Demonstrated experience leading response to complex, high-severity incidents from detection through recovery.
• Advanced proficiency with SIEM and EDR platforms, including complex query development (e.g., Splunk SPL) and detection engineering.
• Deep knowledge of Windows, Linux, Active Directory, and cloud attack techniques, including persistence, privilege escalation, and lateral movement.
• Hands-on experience with digital forensics (memory, disk, and log analysis) and malware analysis.
• Proficiency in Python or PowerShell for automation, data analysis, and tooling.
• Proven ability to mentor analysts and communicate technical findings to executives and non-technical stakeholders.

Responsibilities

• Serve as incident commander for ransomware intrusion containment across IT, infrastructure, and leadership.
• Perform memory forensics on a compromised server to identify in-memory implants and C2 activity.
• Lead a threat hunt for credential dumping and lateral movement after a threat intel refresh.
• Reverse engineer a malicious attachment to extract IOCs and build behavior-based detections.
• Run a purple team exercise to validate detection of ATT&CK techniques and report coverage gaps.
• Investigate a potential business email compromise targeting finance, including mailbox rule analysis and OAuth abuse.
• Deliver an executive-ready incident summary covering root cause, business impact, and remediation recommendations.

Skills

Incident leadership

Memory forensics

Threat hunting

Executive communication

Automation scripting

Python/PowerShell

SPL queries

XQL queries

Mentoring

On-call readiness

Education

Bachelor's degree or equivalent

4+ years in cybersecurity

Tools

SIEM

EDR

Splunk ES

Cortex XSOAR

PowerShell

Python

VS Code

Job description

• Serve as incident commander for a suspected ransomware intrusion, coordinating containment across IT, infrastructure, and leadership while preserving evidence
• Perform memory forensics on a compromised server to identify an in-memory implant and its command-and-control infrastructure
• Lead a threat hunt for credential dumping and lateral movement following a new threat intelligence report
• Reverse engineer a malicious attachment to extract IOCs and build behavior-based detections that remain effective when IOCs change
• Run a purple team exercise to validate detection of priority ATT&CK techniques and deliver a prioritized coverage gap report
• Investigate a potential business email compromise targeting finance, including mailbox rule analysis and OAuth application abuse
• Deliver an executive-ready incident summary covering root cause, business impact, and remediation recommendations

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience
• 6+ years of experience in cybersecurity, including at least 4 years in SOC, incident response, or threat hunting roles
• Demonstrated experience leading response to complex, high-severity incidents from detection through recovery
• Advanced proficiency with SIEM and EDR platforms, including complex query development (e.g., Splunk SPL) and detection engineering
• Deep knowledge of Windows, Linux, Active Directory, and cloud attack techniques, including persistence, privilege escalation, and lateral movement
• Hands-on experience with digital forensics (memory, disk, and log analysis) and malware analysis
• Proficiency in Python or PowerShell for automation, data analysis, and tooling
• Proven ability to mentor analysts and communicate technical findings to executives and non-technical stakeholders
• Ability to make sound decisions under pressure and act as technical lead during critical incident willingness to participate in on-call rotation as the senior escalation resource
• Experience with scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense Operation and Investigation
• Ability to develop, execute queries (e.g., SPL, XQL) and scripts (Python, PowerShell) using VS Code for log analysis, and automated simulation of security scenarios to validate detection rules
• Experience monitoring deployed detections for failures, query errors, and logic gaps; investigate detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.

Preferred Qualifications

• Industry certifications such as CISSP, GIAC GCFA, GCIH, GREM, GCTI, or OSCP
• Experience developing Cortex XSOAR content and implementing risk-based alerting in Splunk ES
• Experience responding to incidents in cloud environments (AWS, Azure, or Google Cloud) and Microsoft 365
• Experience planning or running purple team and adversary emulation exercises
• Experience in retail, payments, or PCI DSS-regulated environments, including familiarity with breach notification requirements
• Prior experience as an incident commander, SOC shift lead, or team lead