SOC Security Analyst L3

BlueVoyant; Maryland Park (MD); Hybrid; USD 110,000 - 150,000; Full time

Job summary

BlueVoyant seeks a SOC Security Analyst L3 to join our Security Operations Center in Maryland. You will lead complex investigations, mentor junior analysts, and coordinate with clients to remediate incidents.

The role demands strong incident response, SIEM/EDR expertise, and clear communications under pressure. Hybrid work arrangement in Maryland with a 4x10 shift pattern and close collaboration with global teams.

Qualifications

• Experience leading security investigations and incident response.
• Proficient with SIEM/EDR detection development.
• Strong written and verbal communication with clients.

Responsibilities

• Monitor and analyze security events from SIEM/EDR sources.
• Provide technical escalation for active intrusions.
• Lead complex investigations and live response analysis.
• Research indicators to determine reputation and suspicious activity.
• Perform malware/forensic analysis and attacker infrastructure review.
• Hunt for suspicious activity using threat intel.
• Ensure events are properly identified and escalated to incidents.
• Deliver incident investigation reports with remediation actions.
• Communicate incident status and guidance to clients.
• Mentor junior analysts and review investigations.
• Assist in security policy and automation improvements.

Skills

SIEM experience

EDR experience

Cloud App Security

Active Directory

Entra ID

Incident response

Threat hunting

Documentation

Client communication

Tools

Microsoft Sentinel

Splunk

Job description

Position: SOC Security Analyst L3
Reports To: SOC Team Lead
Department: Security Operations Center (SOC)
Location: Hybrid, Maryland
Shift Requirement: 4x 10 Hour Shifts. Wednesday - Saturday or Sunday - Tuesday. Exact shift timings TBC
Work Authorization: US Citizenship Required

BlueVoyant is seeking a SOC Security Analyst L3 to join our Security Operations Center, defending our global customers against constant and evolving adversary activity. As the senior technical expert and escalation point for your team, you will handle active intrusions, lead complex investigations, and ensure attacks against our clients are handled with urgency, accuracy, and clear communication. You will mentor junior analysts, act as a trusted voice for clients, and contribute directly to technology strategy and process improvement. This role reports into BlueVoyant SOC leadership and operates under BlueVoyant processes, tooling, and supervision at all times, including when working within client environments.

What You'll Do:

• Monitor and analyze security events and alerts from multiple sources, including SIEM logs, endpoint logs, and EDR telemetry.
• Act as the technical escalation point for active intrusions and escalations from junior analysts.
• Execute complex investigations, handle incident declaration, and perform live response analysis of compromised endpoints.
• Research indicators and activities to determine reputation and suspicious attributes.
• Perform analysis of malware, attacker network infrastructure, and forensic artifacts.
• Hunt for suspicious activity based on anomalous behavior and curated threat intelligence.
• Ensure events are properly identified, analyzed, and escalated to incidents.
• Participate in the response, investigation, and resolution of security incidents, and engage BlueVoyant Incident Response teams for active intrusions.
• Deliver clear incident investigation, handling, and response documentation that leaves clients with defined remediation actions.
• Communicate regularly with clients to inform them of incidents and support remediation.
• Identify and tune false-positive or benign detections.
• Perform peer review and QA of junior analyst investigations, and mentor lower-level analysts.
• Assist in the advancement of security policies, procedures, and automation.
• Support the Customer Success team with client engagements when required.
• Operate across BlueVoyant-managed systems and client-provided environments in accordance with client-approved access controls, logging, and BlueVoyant operating procedures, maintaining strict separation and adherence to security policies.

What You'll Bring

• Ability to handle high-pressure situations in a productive and professional manner.
• Advanced written and verbal communication skills, with the ability to present complex technical topics in clear, easy-to-understand language.
• Strong teamwork and interpersonal skills, including working effectively within a globally distributed team.
• Ability to work directly with clients to understand requirements and gather feedback on security services.
• Knowledge and experience with SIEM solutions, Cloud App Security tools, and EDR.
• Experience with SIEM/EDR detection creation.
• Expertise in endpoint, web, and authentication log analysis.
• Advanced knowledge of network protocols, network telemetry, and commonly abused protocols.
• Experience responding to modern authentication attacks against Active Directory, Entra ID, OAuth, and SSO.
• Expert knowledge of common attack paths, including LOLBin use, common adversary tools, business email compromise (BEC), and AiTM attacks, including identification and response.
• Strong knowledge of:
  • SIEM workflows (preferably Microsoft Sentinel and Splunk)
  • Malware detection, including dynamic and light static analysis, and Windows PE and maldoc analysis
  • Network monitoring metadata (web logs, firewall logs, WAF/IDS)