SOC Analyst

Wow Remote Teams; United States; Remote; USD 70,000 - 95,000; Full time

Job summary

Wow Remote Teams is seeking a SOC Analyst to strengthen cybersecurity operations for a U.S. law firm client. You will investigate threats, manage incidents from detection through resolution, and own tickets end-to-end.

The ideal candidate has 2–4 years in security operations, MSSP coordination, and experience with Defender/SentinelOne. You will improve security controls across Microsoft 365 and endpoints and collaborate with internal and external teams.

Qualifications

• 2–4 years of professional cybersecurity experience in security operations or incident response.
• Hands-on with Defender, SentinelOne, or Sentinel safety tools.
• Knowledge of EDR technologies and SIEM platforms.
• Experience handling security alerts and incident lifecycle.

Responsibilities

• Review and investigate alerts escalated by MSSP.
• Serve as primary internal contact for security incidents.
• Own security tickets from detection to resolution.
• Investigate activities, assess threats, remediate as needed.
• Monitor and strengthen Microsoft 365 security controls.
• Use EDR tools to identify and contain threats.
• Support monitoring with Defender, Sentinel, or similar tools.
• Collaborate with external providers and internal stakeholders.
• Identify gaps and recommend improvements to configurations.
• Assist with cybersecurity policy development and implementation.
• Validate controls against evolving threats.
• Present security recommendations to stakeholders.
• Maintain documentation of investigations and actions.
• Identify opportunities to enhance incident response.

Skills

Analytical thinking

Advanced English

Communication

Independent work

Problem-solving

Education

Cybersecurity/IT related degree or equivalent

Tools

Microsoft Defender

Microsoft Sentinel

SentinelOne

SIEM platforms

Job description

Our client is looking for a SOC Analyst to strengthen their cybersecurity operations, investigate security threats, and ensure incidents are effectively managed from detection through resolution. They are an established U.S. law firm recognized for their continued growth, legal expertise, and commitment to delivering high-quality professional services.

The ideal candidate is a proactive, hands-on security professional with 2–4 years of experience in security operations, incident response, and endpoint protection. This role requires someone who can independently evaluate alerts escalated by a Managed Security Service Provider (MSSP), take full ownership of security incidents, and strengthen security controls across Microsoft 365 and endpoint environments.

Responsibilities

• Review, prioritize, and investigate security alerts escalated by the organization's Managed Security Service Provider (MSSP).


• Serve as the primary internal contact for security incidents, ensuring potential threats are promptly investigated and addressed.


• Take ownership of security tickets throughout their entire lifecycle, from initial investigation to complete resolution and documentation.


• Investigate suspicious activities, assess potential threats, and execute appropriate remediation procedures.


• Monitor, configure, and strengthen security controls within Microsoft 365 environments.


• Utilize endpoint detection and response (EDR) solutions to identify, contain, and remediate security threats.


• Work with Microsoft Defender, Microsoft Sentinel, SentinelOne, or comparable security technologies to support monitoring and incident response activities.


• Collaborate with external security providers and internal stakeholders to coordinate investigations and ensure proper incident resolution.


• Identify gaps in existing security configurations and recommend practical improvements.


• Support the review, development, and implementation of cybersecurity policies and procedures.


• Validate existing security controls to ensure they provide appropriate protection against emerging threats.


• Present security recommendations to relevant stakeholders and implement approved improvements.


• Maintain accurate documentation of security investigations, remediation actions, and ticket resolutions.


• Proactively identify opportunities to improve the organization's overall security posture and incident response processes.

Requirements

• 2–4 years of professional experience in cybersecurity, security operations, SOC environments, or incident response.


• Hands-on experience with at least one of the following: Microsoft Defender, Microsoft Sentinel, or SentinelOne.


• Practical knowledge of endpoint detection and response (EDR) technologies.


• Experience investigating security alerts, identifying malicious activity, and responding to security incidents.


• Ability to manage security tickets independently from initial detection through final resolution.


• Knowledge of Microsoft 365 security configurations, threat protection, and security best practices.


• Experience implementing remediation actions and verifying successful incident resolution.


• Strong understanding of security monitoring, threat detection, and incident response workflows.


• Ability to evaluate security risks and recommend appropriate corrective actions.


• Strong analytical, troubleshooting, and problem-solving capabilities.


• Ability to prioritize security incidents and work independently with minimal supervision.


• Strong communication skills to explain security findings and recommendations to technical and nontechnical stakeholders.


• Advanced English proficiency for communication with a U.S.-based team.


• Availability to work during Eastern Time business hours.

Qualifications

• Educational background or equivalent practical experience in Cybersecurity, Information Technology, Computer Science, Information Security, or a related field.


• Experience collaborating with Managed Security Service Providers (MSSPs).


• Familiarity with Security Information and Event Management (SIEM) platforms and security alert correlation.


• Knowledge of cybersecurity policies, security hardening, and risk mitigation.


• Experience working in security operations environments handling sensitive or confidential information.


• Familiarity with security frameworks and industry best practices, such as NIST or CIS Controls.


• Knowledge of identity and access management within Microsoft environments.


• Certifications such as Microsoft SC-200, CompTIA Security+, or other relevant cybersecurity credentials are a plus.


• Demonstrated ability to take initiative, investigate technical problems, and implement effective security improvements.


• Full-time position, 100% remote.


• Working schedule: 9:00 AM to 6:00 PM Eastern Time, with approximately one hour of flexibility in either direction.


• Opportunity to collaborate with an established U.S.-based organization.