SOC Analyst – SIEM Detection Engineering

The HT Group; Austin (TX); Sur place; USD 76 000 - 124 000; Temps partiel

Résumé du poste

The HT Group is seeking experienced SOC Analysts for a contract opportunity in Austin, TX. This role focuses on strengthening cybersecurity operations by developing and tuning SIEM detection rules within an Elastic/SIEM environment.

Ideal candidates have hands-on experience in SOC, SIEM rule development, and incident investigation, with familiarity with Elasticsearch, Splunk, Microsoft Sentinel, or QRadar. You will work with IT teams to improve monitoring and threat detection.

Qualifications

• Hands-on experience in a SOC or security monitoring environment.
• Proven ability to create, implement and tune SIEM detection rules.
• Experience with SIEM platforms such as Elasticsearch, Splunk, Microsoft Sentinel, or QRadar.
• Strong understanding of security logs, event correlation, threat detection and incident investigation.
• Ability to work with technical teams and clearly communicate security findings.

Responsabilités

• Develop, configure, test, and implement new SIEM detection and correlation rules to identify cybersecurity threats.
• Review, maintain, and optimize existing detection rules to improve accuracy and reduce false positives.
• Analyze security logs, alerts, and events to identify suspicious activity, security incidents, and potential vulnerabilities.
• Monitor security events and support threat detection, investigation, and incident response activities.
• Work with Elasticsearch and other SIEM technologies to enhance security visibility and detection capabilities.
• Develop and refine security queries, alerting logic, and correlation rules.
• Collaborate with cybersecurity and IT teams to improve security monitoring processes and incident detection.
• Document detection rules, investigation findings, and recommended security improvements.
• Stay current with emerging cybersecurity threats, attack techniques, and detection best practices.

Connaissances

SOC operations

SIEM rule tuning

Threat analysis

Incident investigation

Communication

Outils

Elasticsearch

Splunk

Microsoft Sentinel

QRadar

Description du poste

SOC Analyst – SIEM Detection Engineering

Location: Austin, TX Employment Type: Contract Openings: 1–2 Schedule: 40 hours per week

Position Overview

We are seeking experienced SOC Analysts for a contract opportunity supporting an organization in Austin, TX. This role will focus on strengthening cybersecurity operations through the development, implementation, and optimization of security detection rules within a Security Information and Event Management (SIEM) environment.

The ideal candidate will have hands‑on experience developing and tuning SIEM detection rules, analyzing security events, and identifying potential threats. Experience with Elasticsearch (Elastic Security) is highly preferred, although candidates with strong backgrounds in Splunk, Microsoft Sentinel, or QRadar will also be considered.

This position is ideal for a security professional who enjoys hands‑on detection engineering, threat analysis, and improving security monitoring capabilities.

Key Responsibilities

• Develop, configure, test, and implement new SIEM detection and correlation rules to identify cybersecurity threats.
• Review, maintain, and optimize existing detection rules to improve accuracy and reduce false positives.
• Analyze security logs, alerts, and events to identify suspicious activity, security incidents, and potential vulnerabilities.
• Monitor security events and support threat detection, investigation, and incident response activities.
• Work with Elasticsearch and other SIEM technologies to enhance security visibility and detection capabilities.
• Develop and refine security queries, alerting logic, and correlation rules.
• Collaborate with cybersecurity and IT teams to improve security monitoring processes and incident detection.
• Document detection rules, investigation findings, and recommended security improvements.
• Stay current with emerging cybersecurity threats, attack techniques, and detection best practices.

Required Qualifications

• Hands‑on experience working in a Security Operations Center (SOC) or security monitoring environment.
• Proven experience creating, implementing, and tuning SIEM detection rules.
• Experience with SIEM platforms such as Elasticsearch, Splunk, Microsoft Sentinel, or QRadar.
• Strong understanding of security logs, event correlation, threat detection, and incident investigation.
• Experience analyzing security alerts and identifying malicious or suspicious activity.
• Knowledge of common cybersecurity threats, attack methods, and incident response processes.
• Strong analytical, troubleshooting, and problem‑solving skills.
• Ability to work collaboratively with technical teams and communicate security findings effectively.

Preferred Qualifications

• Hands‑on experience with Elasticsearch, Elastic Security, or the ELK Stack.
• Experience writing detection queries using KQL, EQL, SPL, or similar query languages.
• Familiarity with MITRE ATT&CK and threat detection methodologies.
• Experience improving SIEM performance and reducing alert fatigue through detection rule tuning.
• Experience with security automation, threat hunting, or detection engineering.
• Relevant cybersecurity certifications such as CompTIA Security+, CySA+, GIAC, or equivalent.

Ideal Candidate

The ideal candidate is a hands‑on SOC Analyst or Detection Engineer who has experience building detection rules from scratch rather than solely monitoring existing alerts. They understand how to analyze security data, develop effective detection logic, and continuously improve security monitoring to identify threats while minimizing false positives.