Senior SOC Threat Hunter & Incident Response Engineer

Cetera Financial Group; Dallas (TX); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Health insurance

Mental health benefits

PTO & holidays

401(k) plan

Job summary

Cetera Financial Group is seeking a seasoned SOC Analyst to monitor, investigate, and respond to threats affecting our security posture. The role emphasizes hands‑on incident response, root cause analysis, and proactive threat hunting across cloud and on‑prem environments.

You will collaborate with Cloud Engineering, Network Security, IAM, DevOps, and Governance teams to improve detection coverage and playbooks while maintaining strict SLA adherence for alerts and investigations.

Qualifications

• 5+ years of experience as a SOC Analyst or equivalent.
• 3+ years with NexGen SIEM, M365 Security Suite, Netskope, Proofpoint, Tanium, EDR, and Qualys.
• 5+ years of incident response experience.
• 5+ years of experience handling malicious emails and malware analysis.

Responsibilities

• Monitor and triage security events across platforms and validate alerts.
• Investigate incidents, determine root cause, and recommend containment actions.
• Proactively hunt threats using SIEM queries and telemetry.
• Produce incident reports with findings and recommendations.
• Collaborate with Cloud, Network, IAM, and DevOps teams to improve security controls.
• Maintain SLA adherence for alerts and investigations.
• Participate in on‑call rotations for after‑hours incident response.

Skills

SOC Analysis

Incident Response

Threat Hunting

MITRE ATT&CK

SIEM Tools

EDR Tools

Tools

NexGen SIEM

M365 Security Suite

Netskope

Proofpoint

Tanium

EDR

Qualys

Job description

Cetera Financial Group is seeking a seasoned SOC Analyst to monitor, investigate, and respond to threats affecting our security posture. The role emphasizes hands‑on incident response, root cause analysis, and proactive threat hunting across cloud and on‑prem environments.

You will collaborate with Cloud Engineering, Network Security, IAM, DevOps, and Governance teams to improve detection coverage and playbooks while maintaining strict SLA adherence for alerts and investigations.