Senior SOC Analyst- Tuesday- Saturday

BNY Mellon; Pittsburgh (Allegheny County); On-site; USD 110,000 - 150,000; Full time

Job summary

BNY Mellon seeks a Senior SOC Analyst to join the Security Operations Center in Pittsburgh, PA or Lake Mary, FL. The role supports Tuesday-Saturday coverage, focusing on triage, investigations, and incident response with a strong emphasis on MITRE ATT&CK aligned detections.

You will develop and refine playbooks, mentor junior analysts, coordinate with Threat Intelligence, and tune detections with Engineering to improve log fidelity while maintaining audit-ready documentation.

Qualifications

• 6–10 years in SOC, IR, or threat detection, including Tier 2/3 investigations.
• Bachelor's degree in Information Security, CS, or related; CISSP/CISM preferred.
• Proficiency with SIEM/EDR/SOAR and cloud logs.
• Strong network security and Windows/Linux knowledge.

Responsibilities

• Lead triage and investigation of security alerts and coordinate incident response.
• Perform root-cause analysis and drive containment, eradication, and recovery.
• Correlate events across SIEM, EDR, IDS/IPS, firewalls, cloud logs, and identity platforms.
• Develop and maintain SOC playbooks, runbooks, and detection logic (MITRE ATT&CK).
• Mentor junior analysts and guide investigation techniques and documentation.
• Coordinate with Threat Intelligence to track adversary TTPs and hunt indicators.
• Partner with Engineering to tune detections and improve log fidelity.
• Create incident reports and executive summaries; contribute to metrics.
• Support purple team exercises and post-incident reviews.
• Ensure audit-ready documentation and regulatory policy adherence.

Skills

SOC incident response

Threat detection

MITRE ATTACK

Scripting (Python/PowerShell)

Communication under pressure

Education

Bachelor's degree in Information Security or Computer Science

CISSP/CISM preferred

Tools

Splunk

QRadar

Sentinel

CrowdStrike

Microsoft Defender

SOAR

ServiceNow

Job description

We're seeking a future team member for the role of Senior SOC Analyst to join our Security Operations Center team. This role can be in Pittsburgh PA or Lake Mary FL. Schedule: Tuesday-Saturday.

Key Responsibilities

• Lead triage and investigation of security alerts, escalating and coordinating incident response as needed.
• Perform root cause analysis, scope affected assets, and drive containment, eradication, and recovery.
• Correlate events across SIEM, EDR, IDS/IPS, firewalls, cloud logs, and identity platforms to identify true positives and reduce false positives.
• Develop, refine, and maintain SOC playbooks, runbooks, and detection logic aligned to the MITRE ATT&CK framework.
• Mentor junior analysts and provide guidance on investigation techniques, documentation standards, and operational best practices.
• Coordinate with Threat Intelligence to enrich investigations, track adversary TTPs, and proactively hunt for indicators of compromise.
• Partner with Engineering teams to tune detections, improve log fidelity, and strengthen preventive controls.
• Create clear, actionable incident reports and executive summaries; contribute to metrics and trend analysis.
• Support purple team exercises and post-incident reviews to capture lessons learned and drive continuous improvement.
• Ensure adherence to regulatory and security policies; maintain audit-ready documentation for investigations and incidents.

Qualifications

• 6-10; years of experience in a SOC, incident response, or threat detection role, including Tier 2/3 investigations.
• Bachelor's degree in Information Security, Computer Science, or a related field - Advanced certifications such as CISSP or CISM are preferred
• Advanced proficiency with SIEM (e.g., Splunk, QRadar, Sentinel), EDR (e.g., CrowdStrike, Microsoft Defender), and SOAR platforms.
• Strong knowledge of network security, Windows/Linux, identity systems, and common cloud logging sources.
• Hands-on experience with the MITRE ATT&CK framework, threat hunting, IOC/IOA development, and detection tuning.
• Demonstrated ability to lead complex incidents, coordinate stakeholders, and communicate clearly under time pressure.
• Scripting or automation experience (e.g., Python, PowerShell) for investigation enrichment and workflow improvements.
• Familiarity with NIST CSF/800-61, CIS Controls, and common regulatory requirements impacting incident response.
• Excellent documentation skills and an evidence-driven approach to investigations.

Preferred Qualifications

• Relevant certifications: GCIA, GCED, GCIH, GCFA, GNFA, CISSP, CCSP, or equivalent experience.
• Experience with ticketing and case management systems (e.g., ServiceNow) and knowledge management practices.
• Prior experience with threat intel platforms, sandboxing tools, and malware triage is a plus.

Work Schedule

• This role is scheduled Tuesday-Saturday, 8:00 AM -4 PM Eastern Time to support operational coverage.
• Occasional flexibility may be required during major incidents or planned exercises.