SOC Analyst IV (R-00252)

True Zero Technologies; Washington (District of Columbia); On-site; USD 110,000 - 150,000; Full time

Job summary

True Zero Technologies in Washington, DC seeks an experienced SOC Analyst IV to provide advanced cybersecurity monitoring, threat detection, incident investigation, and response support within complex federal environments.

This senior role serves as a technical escalation point for SOC activities, leading sophisticated investigations, analyzing emerging threats across Windows, Linux, networks and cloud, and helping strengthen SOPs, playbooks, and detection capabilities across enterprise systems.

Qualifications

• Minimum 6 years in SOC operations or related security disciplines.
• Experience performing advanced incident investigations and escalation.
• Hands-on SIEM, EDR, and cloud security monitoring experience.
• Strong knowledge of Windows and Linux, networking, and cloud security (AWS).
• Proven ability to document findings and communicate to technical and federal stakeholders.
• Security clearance required for High Risk/Public Trust positions.

Responsibilities

• Advanced Security Monitoring & Incident Response: Provide Tier III SOC support for triage, investigations, forensics, and escalation of advanced threats across federal environments.
• Threat Detection & Analysis: Analyze SIEM alerts, endpoint telemetry, network traffic, and threat intel to identify malicious activity and containment actions.
• SOC Tools & Situational Awareness: Maintain visibility into SOC security technologies, monitoring platforms, log sources, and telemetry.
• Incident Investigation & Escalation: Lead investigations, correlate events across data sources, perform root cause analysis, and coordinate escalation with cybersecurity stakeholders.
• SOC Operations & Process Improvement: Lead handovers, maintain incident documentation, and develop/update SOPs and playbooks to improve efficiency.
• Red Team & Purple Team Collaboration: Support exercises, evaluate detection capabilities, identify gaps, and recommend improvements to procedures.
• Technical Leadership & Knowledge Sharing: Mentor junior analysts and drive improvements in threat detection and incident handling.

Skills

SOC operations

Threat detection

Incident response

SIEM

EDR

Windows

Linux

AWS security

Technical communication

Security clearance

Tools

SIEM platforms

EDR technologies

Job description

True Zero Technologies, a veteran-owned small business, was founded on the principle that the purposeful enablement of people and technology in an organization directly ties to the quality of its outcomes. True Zero recognizes that those outcomes begin and end with our people, and that is what we have built a community of like-minded, driven, and passionate individuals and innovators who are aligned in a common goal of delivering top-tier services to our customers. Our culture and commitment have been recognized through numerous accolades, including being named one of the Best Places to Work in 2023 in two categories ("Prosperous and Thriving" ($5MM-$50MM in gross revenue) and "Mid-Atlantic Region" (DC, DE, MD, NC, VA, WV)), and again in 2025 as a Best Places to Work honoree. In addition, True Zero earned coveted spots on the Inc. 5000 list of fastest-growing companies in America in 2022, 2023, and 2025, a testament to our sustained growth driven by our people-first approach and unwavering dedication to excellence.

Position Overview

True Zero Technologies is seeking an experienced SOC Analyst IV to provide advanced cybersecurity monitoring, threat detection, incident investigation, and response support within complex federal environments. This senior-level position will serve as a technical escalation point for Security Operations Center (SOC) activities, leading sophisticated security investigations, analyzing emerging threats, and ensuring effective detection and response capabilities across enterprise systems.

The ideal candidate will possess extensive hands‑on SOC experience, strong analytical and troubleshooting skills, and deep technical expertise in Security Information and Event Management (SIEM) platforms, endpoint security, network analysis, and cloud security monitoring.

Job Responsibilities

• Advanced Security Monitoring & Incident Response:Provide Tier III SOC support for security alert triage, complex incident investigations, forensic analysis, and escalation of advanced security threats across federal enterprise environments.
• Threat Detection & Analysis:Analyze security events, SIEM alerts, endpoint telemetry, network traffic, and threat intelligence to identify malicious activity, determine potential impact, and recommend appropriate containment and remediation actions.
• SOC Tools & Situational Awareness:Maintain comprehensive operational awareness of SOC security technologies, monitoring platforms, log sources, and telemetry to ensure continuous visibility into enterprise security posture and emerging threats.
• Incident Investigation & Escalation:Lead advanced technical investigations, correlate security events across multiple data sources, perform root cause analysis, and coordinate incident escalation and response activities with cybersecurity stakeholders.
• SOC Operations & Process Improvement:Lead shift handovers, maintain incident documentation, and develop, review, and update Standard Operating Procedures (SOPs), incident response playbooks, and operational workflows to improve SOC efficiency and consistency.
• Red Team & Purple Team Collaboration:Support Red Team and Purple Team exercises by evaluating detection capabilities, analyzing simulated attack activity, identifying monitoring gaps, and recommending improvements to threat detection and response procedures.
• Technical Leadership & Knowledge Sharing:Provide technical guidance and mentorship to junior SOC analysts, assist with complex troubleshooting, and contribute to continuous improvements in threat detection, incident handling, and SOC operational effectiveness.

Job Requirements

• Security Operations Experience:Minimum of 6 years of progressive experience in Security Operations Center (SOC) operations, cybersecurity monitoring, threat detection, incident response, or related security disciplines, including advanced incident investigation and escalation responsibilities.
• Professional Certifications:Must possess at least one of the following certifications: GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), Certified Ethical Hacker (CEH), or CompTIA Security+.
• SIEM & Endpoint Security Expertise:Demonstrated hands‑on experience with SIEM platforms, security event correlation, endpoint detection and response (EDR) technologies, endpoint telemetry analysis, and advanced security alert investigation within enterprise environments.
• Operating Systems, Networking & Cloud Security:Strong technical knowledge of Windows and Linux operating systems, network protocols, enterprise networking, and AWS‑native security capabilities, including experience investigating security events across on‑premises and cloud environments.
• Incident Response & Technical Communication:Proven ability to conduct complex security investigations, analyze potential indicators of compromise (IOCs), document technical findings, execute incident escalation procedures, and communicate actionable security recommendations to technical teams and federal stakeholders.
• Security Clearance: Required to meet requirements for High Risk/ Public Trust Contractor Positions.