Sr. SOC Analyst

Insight Global; Coral Gables (FL); On-site; USD 140,000 - 190,000; Full time

Job summary

Insight Global is seeking a Senior SOC Analyst to join our Security Operations Center. You will investigate complex incidents, own investigations from detection through containment, and drive proactive threat hunting across endpoints, networks, cloud, and email.

The ideal candidate has 10+ years IT/security, 5+ years SOC, strong Splunk and CrowdStrike experience, and a track record of improving detection, playbooks, and automation. You'll contribute to mature, threat-focused security operations.

Qualifications

• 10+ years of IT and/or cybersecurity experience.
• 5+ years in Security Operations Center (SOC) roles.
• Strong hands-on incident response and security investigation skills.
• Hands-on experience with Splunk for security investigations and log analysis.
• Experience with threat hunting and cross-environment threats.

Responsibilities

• Monitor, triage, and investigate security alerts across the environment.
• Investigate and respond to complex security incidents from detection to remediation.
• Perform proactive threat hunting to uncover undetected activity.
• Improve SOC playbooks, SOPs, and incident-response processes.
• Identify opportunities to automate SOC workflows.

Skills

Senior SOC Analyst

Threat Hunting

Incident Response

Log Analysis

Automation opportunities

Education

GCIH

GCFA

GCIA

Tools

Splunk

CrowdStrike

SOAR (Tines)

Microsoft Sentinel

Microsoft Defender

Check Point / Palo Alto firewalls

Job description

Job Description

Job Overview

We are seeking a Senior SOC Analyst / L3 SOC Analyst to serve as a senior hands-on member of the Security Operations Center. This person will investigate and respond to complex security incidents while helping the organization move from a reactive security model toward a more proactive SOC.

The ideal candidate will have strong hands-on experience with Splunk, CrowdStrike, incident response, and threat hunting and be comfortable independently owning complex investigations. This person will also help strengthen detection capabilities, improve SOC processes and playbooks, reduce false positives, and identify opportunities for automation.

Day to Day

Monitor, triage, and investigate security alerts across the environment

Use Splunk to search, correlate, and analyze security logs during investigations

Investigate endpoint threats and suspicious behavior using CrowdStrike

Own complex incidents escalated beyond L1/L2

Determine the scope and impact of security incidents and coordinate containment and remediation

Conduct proactive threat hunting to identify activity that may not be captured by existing alerts

Investigate phishing, suspicious email activity, endpoint events, network activity, cloud activity, and firewall events

Identify false positives and opportunities to improve alert quality and detection

Improve SOC playbooks, SOPs, and incident-response processes

Identify opportunities to automate repetitive SOC workflows

Participate in the team's on-call rotation (one week a month)

Partner with security and technology teams throughout investigations

Help mature the SOC toward a more proactive, threat-focused security operation

Skills and Requirements

10+ years of experience in IT and/or cybersecurity

5+ years of hands-on Security Operations Center (SOC) experience

Strong Senior / L3 SOC Analyst experience

Strong hands-on incident response and security investigation experience

Strong Splunk experience for security investigations and log analysis

Strong hands-on CrowdStrike experience

Experience with threat hunting and proactively identifying suspicious activity

Experience investigating threats across endpoint, network, cloud, email, and firewall environments

Strong understanding of SIEM, EDR, NDR, and IDS/IPS technologies

Ability to independently own complex security incidents from investigation through containment and remediation

Experience improving SOC processes, alerting, playbooks, and incident-response proceduresGCIH, GCFA, or GCIA certification

Check Point and/or Palo Alto firewall experience

Tines / SOAR experience

ExtraHop experience

Netskope experience

Microsoft Sentinel and/or Microsoft Defender experience

AWS or Azure security experience

Python, PowerShell, or Bash scripting experience

Experience with security automation

Splunk dashboarding or administration experience

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [e-mail].