SOC Security Analyst: Incident Response & Threat Hunting

Office Ally; Vancouver (WA); On-site; USD 90,000 - 100,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

401(k) with company match

Paid time off

Job summary

Office Ally is seeking a Security Operations Analyst to serve as the first line of defense for our security program. You will close incidents, investigate anomalies, and help build runbooks and detection logic to speed responses.

You’ll work with security engineering, cloud infrastructure, and IT operations to investigate threats, coordinate responses, and maintain audit trails for regulatory compliance.

Qualifications

• Bachelor’s degree in CS/IT/Cybersecurity or related field or equivalent experience.
• 2+ years in a SOC, IT security, or incident response role.
• Reading and writing KQL; able to build hunting queries and modify analytics rules.
• Understanding of Active Directory and Entra ID fundamentals, plus MFA concepts.
• Familiarity with email-based threat investigation and safe/unsafe sender management.
• Knowledge of SOC 2, HIPAA, or HITRUST regulatory requirements.
• Clear written incident notes as part of audit trails.

Responsibilities

• Monitor and triage security incidents across our environment with clear documentation.
• Review endpoint alerts; perform live response sessions as needed.
• Investigate risky OAuth apps, unusual downloads, shadow IT, and policy violations.
• Coordinate vulnerability findings through triage and remediation; maintain audit records.
• Triage phishing, malware, BEC, and user-reported messages; coordinate remediation actions.

Skills

KQL

Microsoft Sentinel

Threat hunting

Active Directory

Entra ID fundamentals

MFA

Incident response

PowerShell

HIPAA / SOC 2 awareness

Education

Bachelor’s degree in CS/IT/Cybersecurity

Tools

Microsoft Defender suite

MDE

MCAS

Defender for Identity

Defender for Office 365

Job description

Office Ally is seeking a Security Operations Analyst to serve as the first line of defense for our security program. You will close incidents, investigate anomalies, and help build runbooks and detection logic to speed responses.

You’ll work with security engineering, cloud infrastructure, and IT operations to investigate threats, coordinate responses, and maintain audit trails for regulatory compliance.