SOC Analyst

Foresite MSP; Overland Park (KS); On-site; USD 60,000 - 85,000; Full time

Job summary

Foresite MSP seeks a SOC Analyst I to start a cybersecurity career within our 24/7 Cyber Fusion Center. You will monitor and triage security alerts across customer environments and learn our detection stack under experienced analysts.

You will handle Tier 1 investigations, document findings in tickets, and collaborate with customers and team leads to improve detections while meeting defined SLAs.

Qualifications

• 0–2 years of experience in a SOC, IT security, IT operations, or helpdesk/NOC role.
• Knowledge of the cyber kill chain or MITRE ATT&CK framework and common attack vectors.
• Familiarity with a SIEM; training provided if Chronicle experience is not present.
• Strong written communication in ticketing and reporting.

Responsibilities

• Monitor and triage security alerts across customer environments during your shift.
• Investigate Tier 1 incidents end-to-end; gather evidence and provide disposition or escalation.
• Follow investigation playbooks for top alert types and flag gaps for improvement.
• Document clear, actionable tickets understandable by customers, auditors, and teammates.
• Collaborate with customers through the ticketing system for routine investigations and requests.
• Meet SLA and quality targets for first-touch time, triage accuracy, and ticket closure quality.
• Participate in shift handoffs and brief the incoming analyst on open investigations.
• Contribute to detections fidelity by flagging noisy rules and alert clusters.

Skills

SOC basics

IT security

IT operations

Helpdesk/NOC

Education

Cybersecurity degree/certificate

Tools

Chronicle SIEM

SOAR platform

Job description

Foresite is seeking a SOC Analyst I who has a passion for security, a keen eye for detail, and a drive to protect organizations from cyberattacks. It's more than just a job; it's a launching pad for your cybersecurity career and a first step towards an exciting future at Foresite.

What You'll Do:

The SOC Analyst I is the entry point to a structured career in Foresite’s Security Operations Center. You will work a dedicated shift inside our 24/7 Cyber Fusion Center, monitoring and triaging security alerts for our managed customers across Google Security Operations (Chronicle), our SOAR platform, and supporting tools. You will learn our detection stack, our customer environments, and our investigation process from experienced analysts and team leads, and you will be measured on clear, published performance criteria that define what it takes to advance to SOC Analyst II.

• Monitor and triage alerts across Google Security Operations (Chronicle) and the Foresite ticketing queue for assigned customer environments during your shift.
• Investigate Tier 1 incidents end-to-end: review alert context, gather evidence from Chronicle UDM and supporting tools, reach an initial disposition, and either close the ticket with a documented rationale or elevate as needed with a clear handoff.
• Follow established investigation playbooks for the top alert types and rule categories in our detection stack, and flag gaps or outdated guidance to your Team Lead for improvement.
• Communicate clearly in tickets. Every ticket you touch should be understandable by the next analyst, the customer, or an auditor reading it six months from now. Your written analysis is the primary artifact of your work.
• Partner with customers through the ticketing system on routine investigations, requests for information, and exclusion/suppression requests under Team Lead oversight.
• Meet SLA and quality targets for first-touch time, triage accuracy, and ticket closure quality as defined in the L1 performance scorecard.
• Participate in shift handoff — brief the incoming analyst on open investigations, anomalies observed during your shift, and anything waiting on customer response.
• Contribute to detections fidelity by flagging noisy rules, false-positive patterns, and alert clusters that should be reviewed by the detection engineering team.

Who you are:

• Experience: 0–2 years of prior experience in a SOC, IT security, IT operations, or helpdesk/NOC role. Recent graduates of a cybersecurity degree or certificate program are encouraged to apply.

• Working knowledge of core security concepts: the cyber kill chain or MITRE ATT&CK framework, common attack vectors (phishing, credential abuse, malware delivery, lateral movement), and the difference between detection, prevention, and response.
• Familiarity with a SIEM: You do not need Chronicle experience on day one — we will train you — but you must be able to explain what a SIEM does, how alerts are generated, and how to pivot from an alert to supporting log evidence.
• Strong written communication: You will be writing in tickets that customers read. Clear