Sr. SOC Analyst

Optomi; Dallas (TX); On-site; USD 120,000 - 170,000; Full time

Job summary

Optomi is seeking a Senior SOC Analyst / Incident Response Analyst to support a growing Security Operations Center with a focus on OT environments. You will investigate alerts, analyze logs, and manage incidents from detection to resolution in a hands-on role.

The ideal candidate has 5+ years in SOC/IR, experience with CrowdStrike Falcon and OT/ICS monitoring, and the ability to work independently in a fast-paced, shift-enabled environment.

Qualifications

• 5+ years in Security Operations, SOC analysis, and incident response.
• Experience handling incidents beyond initial triage (Tier 2/3).
• Hands-on CrowdStrike Falcon experience for threat detection.
• Strong log analysis, event correlation, and network traffic skills.
• OT/ICS/IoT exposure preferred.

Responsibilities

• Monitor, triage, and investigate security alerts across IT and OT.
• Perform in-depth log analysis and correlate events from multiple sources.
• Lead incident response bridges for high-priority incidents.
• Document findings, timelines, evidence, and resolutions.
• Assess incident severity and decide escalation.
• Collaborate with security teams and stakeholders.

Skills

SOC analysis

Incident investigation

Log analysis

Analytical thinking

Independent work

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

CrowdStrike Falcon

Nozomi Networks

Job description

Optomi, partnered with a client in the IT Services & Solutions side, is seeking an experienced Senior SOC Analyst / Incident Response Analyst to support a growing Security Operations Center (SOC) with a focus on Operational Technology (OT) environments.

This position requires a hands-on security professional who can independently investigate security alerts, analyze logs, identify potential threats, and manage incidents from initial detection through resolution.

The ideal candidate brings strong technical investigation skills, sound judgment, and the ability to operate independently in a fast-paced environment. While prior OT security experience is preferred, candidates with a strong background in traditional IT security operations and exposure to OT environments will also be considered.

Key Responsibilities

• Monitor, triage, and investigate security alerts across IT and OT environments using tools such as CrowdStrike Falcon and Nozomi Networks.
• Perform in-depth log analysis and correlate security events across multiple data sources to identify suspicious or malicious activity.
• Independently investigate security incidents from initial detection through final determination, distinguishing legitimate threats from false positives.
• Analyze network activity, DNS queries, IP addresses, hostnames, user activity, and endpoint telemetry to identify potential security concerns.
• Lead and coordinate incident response bridges for high-priority security incidents, communicating findings and driving investigations forward.
• Document investigation findings, incident timelines, technical evidence, and resolution steps accurately and thoroughly.
• Evaluate security events, determine incident severity, and make informed decisions regarding escalation and response.
• Investigate security events involving operational technology, including industrial systems, building management systems, and connected devices.
• Collaborate with security teams and other stakeholders to ensure effective incident response, communication, and shift handoffs.
• Identify opportunities to improve monitoring effectiveness, investigation processes, and overall SOC operations.

Required Qualifications

• 5+ years of hands‑on experience in Security Operations, SOC analysis, incident investigation, or incident response.
• Strong experience investigating security incidents beyond initial alert triage, preferably in a Tier 2 or Tier 3 SOC capacity.
• Hands‑on experience using CrowdStrike Falcon or comparable EDR technologies for threat detection and investigation.
• Strong understanding of log analysis, security event correlation, and network traffic analysis.
• Experience investigating security events involving IP addresses, DNS activity, user authentication, endpoint activity, and other security telemetry.
• Demonstrated ability to independently assess security alerts, determine severity, and make decisions regarding incident escalation.
• Experience participating in or leading security incident response activities, including incident bridges and technical investigations.
• Strong understanding of incident response processes, security monitoring, and threat detection methodologies.
• Excellent analytical, troubleshooting, communication, and documentation skills.
• Ability to work independently, manage competing priorities, and collaborate effectively with distributed security teams.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.

Preferred Qualifications

• Experience securing or monitoring Operational Technology (OT), Industrial Control Systems (ICS), or IoT environments.
• Hands‑on experience with Nozomi Networks for OT asset monitoring, threat detection, or security investigations.
• Familiarity with OT-specific communication protocols, industrial devices, or building management systems.
• Experience working in an environment requiring independent, end-to-end incident ownership.
• Previous experience supporting a 24/7 SOC operation.
• Relevant cybersecurity certifications such as GCIH, GCIA, GCFA, CySA+, or Security+.

What Makes Someone Successful in This Role?

We're looking for someone who goes beyond simply monitoring dashboards and escalating alerts.

Successful candidates will demonstrate strong critical thinking, curiosity, and the ability to investigate unfamiliar security events with minimal supervision. You'll need to be comfortable digging into logs, connecting technical evidence, making informed decisions, and clearly explaining your findings to both technical and nontechnical stakeholders.

This is an opportunity for a technically strong SOC professional to take ownership of meaningful investigations and contribute to the continued development of an evolving security operations program.