Senior SOC Incident Commander & Threat Hunter

Motion Recruitment; Irving (TX); On-site; USD 120,000 - 180,000; Full time

Job summary

Motion Recruitment seeks a senior SOC Analyst III to lead investigations and incident response for high-impact security events. You will act as a technical authority within the SOC, guiding detection engineering, threat hunting, and mentoring junior analysts.

The role focuses on coordinating response across telemetry sources, building detections in Splunk ES, and mapping to MITRE ATT&CK, while communicating findings to leadership and stakeholders.

Qualifications

• Strong hands-on Splunk experience and Splunk coding, with developing or tuning searches and detections.
• Experience leading complex security incident investigations and response.
• Ability to correlate security data across multiple telemetry sources.

Responsibilities

• Lead or serve as incident commander for critical events (e.g., ransomware, data exfiltration, insider threats).
• Investigate endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact.
• Build incident timelines by correlating data across Splunk ES, Cortex, and other log sources.
• Direct containment, eradication and recovery actions; coordinate remediation with infrastructure and apps teams.
• Preserve forensic evidence and maintain chain-of-custody documentation.

Skills

Splunk ES

Incident response

Threat hunting

MITRE ATT&CK

Log correlation

Tools

Splunk ES

Palo Alto Cortex

Job description

Motion Recruitment seeks a senior SOC Analyst III to lead investigations and incident response for high-impact security events. You will act as a technical authority within the SOC, guiding detection engineering, threat hunting, and mentoring junior analysts.

The role focuses on coordinating response across telemetry sources, building detections in Splunk ES, and mapping to MITRE ATT&CK, while communicating findings to leadership and stakeholders.