SOC Analyst II

SRI Resources; Irving (TX); On-site; USD 90,000 - 130,000; Full time

Job summary

SRI Resources is seeking a SOC Analyst II for an on-site, multi-month contract in Irving, TX. You will escalate, investigate, and lead containment for complex incidents, while developing detections and playbooks and mentoring junior staff.

The role requires strong SIEM/EDR experience, knowledge of Windows/Linux, and the ability to collaborate with cross-functional teams to restore operations and strengthen defenses.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience.
• 3-5 years of experience in security operations, incident response, or related cybersecurity role, including at least 2 years as a SOC analyst.
• Hands-on experience investigating incidents using SIEM and EDR platforms, including writing search queries (e.g., Splunk SPL).
• Solid understanding of Windows and Linux operating systems, Active Directory, and common log sources such as Windows Event Logs, Sysmon, firewall, and proxy logs.
• Experience applying MITRE ATT&CK to investigations and detection development.
• Ability to lead response for medium- and high-severity incidents and communicate with stakeholders.
• Experience scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense operations.
• Ability to develop and execute queries and scripts for log analysis and detection validation.

Responsibilities

• Investigate escalated alerts and incidents as the primary escalation point for Level 1 analysts.
• Lead containment, eradication, and recovery for medium- and high-severity incidents.
• Develop new detection rules and correlation searches mapped to MITRE techniques.
• Mentor Level 1 analysts and contribute to SOPs, playbooks, and runbooks.
• Create incident reports detailing root cause, actions taken, and recommendations.

Skills

Incident response

Root cause analysis

Communication skills

Scripting: PowerShell

Splunk SPL

Education

Bachelor's degree in Cybersecurity or related

Tools

Splunk ES

Palo Alto Cortex

Cortex XSOAR

ServiceNow

Jira

Job description

SRI Resources (a 24 Seven Company) has an immediate, contract job opportunity for a SOC Analyst II with a major corporation, on-site in Irving/Dallas, TX.

12+ month contract

Summary:

You serve as the escalation point for Level 1 analysts in the Security Operations Center, performing in-depth investigations into escalated alerts and confirmed security incidents. You determine root cause, scope, and impact, lead containment and remediation for medium- and high-severity incidents within your authority, and coordinate with IT and business teams to restore normal operations. You develop and tune detections, contribute to response automation and playbooks, and mentor Level 1 analysts. You escape critical or highly complex incidents to Level 3 analysts, the SOC Manager, and incident response leadership.

Key Responsibilities:

Investigate escalated alerts and incidents

• Serve as the primary escalation point for Level 1 analysts, validating triage decisions and taking ownership of escalated alerts
• Perform in-depth investigations across endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact
• Build incident timelines by correlating data across Splunk ES, Palo Alto Cortex, and supporting log sources
• Assess incident severity and business impact, and elevate to Level 3 analysts or incident response leadership when defined thresholds are met

Lead containment and response

• Lead containment, eradication, and recovery for medium- and high-severity incidents within defined authority, including host isolation, account disablement, and IOC blocking
• Coordinate with IT infrastructure, identity, and application teams to execute and verify remediation actions
• Collect and preserve forensic evidence such as logs, endpoint artifacts, and memory captures, and maintain chain-of-custody documentation
• Write incident reports summarizing root cause, actions taken, and recommendations, and contribute findings to post-incident reviews

Improve detection and automation

• Develop new detection rules and correlation searches in Splunk ES mapped to MITRE Telecommunication&CK techniques
• Tune detections based on false-positive trends and alert metrics, validating changes against historical data before deployment
• Identify repetitive analyst tasks and help build or enhance Cortex XSOAR playbooks for enrichment and response automation
• Operationalize threat intelligence by converting IOCs and TTPs into searches, watchlists, and detections
• Conduct hypothesis-driven threat hunts on emerging threats with guidance from Level 3 analysts

Mentor analysts and strengthen SOC operations

• Mentor and coach Level 1 analysts, reviewing ticket quality and providing feedback on investigation and documentation practices
• Create and update SOPs, playbooks, and runbooks based on investigation findings and lessons learned
• Track and report SOC metrics such as mean time to detect (MTTD), mean time to respond (MTTR), escalation accuracy, and false-positive rates
• Participate in the on-call rotation as an escalation resource and contribute to tabletop exercises and drills

Tools and Technologies You Might Use

• SIEM: Splunk ES, including SPL searches, correlation searches, and dashboards
• EDR: Palo Alto Cortex, including live response and host isolation
• SOAR and ticketing: Palo Alto Cortex XSOAR, ServiceNow, Jira
• Network security: firewalls, IDS/IPS, proxy and DNS logs, packet capture analysis (e.g., Wireshark)
• Identity and email: Active Directory / Entra ID authentication logs, email security gateway logs
• Threat intelligence and analysis: VirusTotal/Google Threat Intelligence, Recorded Future, malware analysis sandboxes
• Frameworks: MITRE Telecommunication&CK, NIST incident response lifecycle, Cyber Kill Chain

Examples of Work and Technical Scope

• Investigate an escalated phishing campaign affecting multiple users, identify all recipients and clicks, and coordinate mailbox purges and credential resets
• Analyze a suspicious PowerShell or living-off-the-land execution chain to determine initial access, persistence, and any lateral movement
• Build a Splunk correlation search to detect impossible-travel or anomalous MFA activity and validate it against historical data
• Lead containment of a malware infection across several endpoints, including isolation, IOC sweeps, and verification of eradication
• Develop a Cortex XSOAR playbook that automates IOC enrichment for phishing alerts to reduce Level 1 handling time
• Review a week of Level 1 tickets and deliver coaching feedback on triage accuracy and documentation quality

Required Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience
• 3-5 years of experience in security operations, incident response, or a related cybersecurity role, including at least 2 years as a SOC analyst
• Hands-on experience investigating incidents using SIEM and EDR platforms, including writing search queries (e.g., Splunk SPL)
• Solid understanding of Windows and Linux operating systems, Active Directory, and common log sources such as Windows Event Logs, Sysmon, firewall, and proxy logs
• Working knowledge of networking and protocols, including TCP/IP, DNS, HTTP/S, and SMTP, with the ability to analyze network traffic
• Practical experience applying MITRE Telecommunication&CK to investigations and detection development
• Ability to lead response for medium- and high-severity incidents and communicate clearly with technical and non-technical stakeholders
• Strong written communication skills for incident reports, playbooks, and procedures
• Willingness to work shift-based coverage and participate in on-call rotation as an escalation resource
• Experience with scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense Operation and Investigation
• Ability to develop, execute queries (e.g., SPL, XQL) and scripts (Python, PowerShell) using VS Code for log analysis, and automated simulation of security scenarios to validate detection rules
• Experience monitoring deployed detections for failures, query errors, and logic gaps; investigate detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.

Preferred Qualifications:

• Industry certifications such as CompTIA CySA+, GIAC GCIH, GIAC GCIA, or Splunk Certified Cybersecurity Defense Analyst
• Scripting experience in Python or PowerShell to automate enrichment, log parsing, or response tasks
• Experience building or maintaining SOAR playbooks, preferably in Cortex XSOAR
• Experience monitoring cloud and SaaS environments (e.g., AWS, Azure, Google Cloud, Microsoft 365)
• Experience working in retail, payments, or PCI DSS-regulated environments