Sr. SOC Analyst

Insight Global; United States; Sur place; USD 140 000 - 190 000; Plein temps

Résumé du poste

Insight Global seeks a senior cybersecurity operations leader to monitor and respond to threats across Windows, Linux, cloud, and network environments. You will drive incident response, threat hunting, and security analytics within a collaborative SOC landscape.

The role emphasizes hands-on investigations, playbook development, and coordination with IT and security partners to strengthen detection capabilities and reduce risk. This is an on-site position in the United States.

Qualifications

• 10+ years of related work experience in IT and cybersecurity.
• 5+ years in operational SOC/NOC environments.
• Bachelor's degree in computer security/CS/CE preferred.
• Security certifications preferred (GSEC, GCED, GCIA, GCIH, GCFA, AWS/Azure).
• Strong experience with SIEM platforms, security monitoring, log analysis, and analytics.
• Hands-on with SIEM, IDS/IPS, EDR, NDR, email/web security gateways, and related solutions.
• Strong knowledge of Windows and Linux operating systems; admin experience preferred.
• Understanding of TCP/IP networking and protocols (DNS, HTTP/S, SMB).
• Knowledge of cybersecurity threats, TTPs, exploits, and mitigations.
• Experience with Python, PowerShell, and Bash scripting.
• Knowledge of AWS and Microsoft Azure cloud security services.
• SOAR technologies experience preferred.
• Strong analytical, troubleshooting, and communication skills.
• Ability to document findings for diverse stakeholders.

Responsabilités

• Monitor, collect, and analyze security telemetry and alerts from Windows, Linux, network, cloud, SIEM, NDR, EDR, IDS/IPS, and firewalls to identify incidents.
• Triage and investigate alerts to determine false positives, scope, and remediation needs.
• Lead complex cybersecurity investigations and incident response activities with containment and coordination.
• Conduct proactive threat hunting to identify suspicious behaviors and emerging threats.
• Investigate phishing emails and other threats with users and teams to implement corrective actions.
• Research emerging threats, attack techniques, and vulnerabilities to inform detections.
• Develop, document, maintain, and automate IR procedures using SOAR platforms such as Tines.
• Collaborate with internal security teams and external partners to improve detection and response.
• Evaluate and improve SOC processes, playbooks, SOPs, and automation workflows.
• Coordinate with IT, infrastructure, network, and cloud teams for effective IR.
• Identify opportunities to improve monitoring coverage and reduce false positives.
• Communicate investigation findings, risks, and actions to technical and non-technical stakeholders.
• Prepare reports on incidents, metrics, and security trends for management.
• Contribute to continuous improvement of SOC operational effectiveness and readiness.

Connaissances

IT & cybersecurity experience

SOC/NOC operations

Strong communication

Analytical problem-solving

Threat hunting

Python/PowerShell/Bash scripting

Security governance and incident

Formation

Bachelor's degree in Computer Security/CS/CE

Outils

SIEM platforms

IDS/IPS

EDR

NDR

SOAR (Tines)

Cloud security (AWS/Azure)

Windows

Linux

Description du poste

Minimum Qualifications:

• 10+ years of related work experience in IT and cybersecurity.
• 5+ years of experience working in an operational environment, such as a Security Operations Center (SOC) or Network Operations Center (NOC).
• Bachelor's degree in a relevant field, such as Computer Security, Computer Science, Computer Engineering, or a related discipline, preferred.
• One or more relevant security certifications preferred, including GSEC, GCED, GCIA, GCIH, GCFA, AWS Certified Security – Specialty, or Microsoft Certified: Azure Security Engineer Associate.
• Strong experience with Security Information and Event Management (SIEM) platforms, security monitoring, log analysis, and security analytics.
• Hands-on experience with enterprise security technologies, including SIEM, IDS/IPS, endpoint detection and response (EDR), network detection and response (NDR), email/web security gateways, and other security detection and mitigation solutions.
• Strong knowledge of Windows and Linux operating systems, including system architecture, security events, authentication mechanisms, and common attack techniques. System administration experience preferred.
• Strong understanding of TCP/IP networking and common protocols and services, including DNS, HTTP/S, SMB, and related network communications.
• Demonstrated knowledge of current cybersecurity threats, adversary tactics, techniques, and procedures (TTPs), technical exploits, and mitigation strategies.
• Experience with Python, PowerShell, and Bash scripting strongly desired.
• Experience with digital forensics, incident investigation, and evidence analysis strongly desired.
• Knowledge of AWS and Microsoft Azure cloud infrastructure, security services, and monitoring capabilities strongly desired.
• Experience with security orchestration, automation, and response (SOAR) technologies preferred.
• Strong analytical, troubleshooting, and problem-solving skills with excellent attention to detail.
• Strong written and verbal communication skills, including the ability to document technical findings and communicate effectively with diverse stakeholders.

Responsibilities:

• Monitor, collect, and analyze security telemetry and alerts from diverse sources, including Windows, Linux, network infrastructure, cloud environments, SIEM, NDR, EDR, IDS/IPS, and firewalls, to identify suspicious activity and potential security incidents.
• Triage and investigate security alerts to identify false positives, determine the scope and impact of potential incidents, and coordinate timely response and remediation activities.
• Lead complex cybersecurity investigations and incident response activities, including evidence collection, analysis, containment, and remediation coordination.
• Conduct proactive threat hunting to identify suspicious behaviors, emerging threats, and potential security gaps that may not be detected through existing alerting capabilities.
• Investigate phishing emails and other email-based threats, working with users and relevant teams to implement appropriate corrective actions.
• Research emerging cybersecurity threats, attack techniques, and vulnerabilities that may impact the organization, and recommend appropriate detection improvements and mitigation strategies.
• Develop, document, maintain, and automate incident response procedures and workflows using security orchestration and automation platforms, including Tines.
• Collaborate with internal security teams and external security partners to improve detection capabilities, security analytics, threat hunting, and incident response effectiveness.
• Evaluate and continuously improve SOC processes, incident response playbooks, standard operating procedures (SOPs), and security automation workflows.
• Collaborate with IT, infrastructure, network, cloud, and other security teams to ensure effective incident investigation, escalation, response, and resolution.
• Identify opportunities to improve security monitoring coverage, reduce false positives, enhance alert quality, and streamline incident response processes.
• Communicate investigation findings, security risks, and recommended actions to technical and nontechnical stakeholders.
• Prepare and present reports on security incidents, operational metrics, emerging threats, and security trends to management.
• Contribute to the continuous improvement of the SOC's overall operational effectiveness, detection capabilities, and incident response readiness.