Senior SOC Analyst — AI-Driven Incident Response

BeyondTrust; United States; On-site; USD 90,000 - 130,000; Full time

Job summary

BeyondTrust seeks a security operations professional to triage alerts, conduct incident investigations, and drive detection engineering and AI-assisted automation. You will work across SIEM, EDR, CSPM, and cloud sources, leading IR efforts, documenting findings, and maturing playbooks.

Strong communication and a background in privileged access security are preferred. The role emphasizes hands-on response, threat intelligence translation, and collaboration with engineering to improve data quality

Qualifications

• 2+ years of experience in a SOC, security operations, or incident response role.

Responsibilities

• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.
• Investigate alerts to determine scope, severity, and whether escalation is warranted.
• Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.
• Classify, document, and track alerts through the full lifecycle using ticketing and case management systems.
• Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.
• Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure.
• Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows.
• Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.
• Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.
• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps.
• Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors.
• Help maintain and evolve detection coverage mapped to MITRE ATT&CK.
• Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts.
• Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.
• Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows.
• Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort.
• Partner with engineering teams to improve log ingestion, data quality, and tool integrations.
• Maintain daily operational notes and shift handoff documentation.
• Contribute to and refine IR runbooks, playbooks, and standard operating procedures.
• Participate in on-call rotation for after-hours incident escalation.
• Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities.
• Participate in tabletop exercises, purple team activities, and post-incident reviews.

Skills

SOC experience

MITRE ATT&CK familiarity

SIEM experience

EDR familiarity

AI system comfort

Clear writing

Tools

SIEM platform

EDR

SOAR platforms

Job description

BeyondTrust seeks a security operations professional to triage alerts, conduct incident investigations, and drive detection engineering and AI-assisted automation. You will work across SIEM, EDR, CSPM, and cloud sources, leading IR efforts, documenting findings, and maturing playbooks.

Strong communication and a background in privileged access security are preferred. The role emphasizes hands-on response, threat intelligence translation, and collaboration with engineering to improve data quality