Security Operations Center Analyst

Responsibilities

• Monitor security alerts and events in a 24x7 SOC environment
• Perform initial triage and validation of alerts to determine severity and impact
• Conduct advanced alert investigation and analyze security events across identity, endpoint, and network telemetry
• Handle Tier I escalation workflows and support Tier II incident response activities
• Coordinate incident containment efforts and elevate complex incidents to Tier III as needed
• Monitor log ingestion pipelines and ensure data sources are functioning properly
• Document incidents, findings, and response actions in accordance with SOC procedures
• Contribute to daily reporting and provide accurate shift handoff documentation
• Identify trends, anomalies, and potential threats through continuous monitoring and analysis
• Collaborate with cross-functional teams to support incident resolution and improve detection capabilities

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, or a related field, or equivalent work experience
• Minimum of 4 years of experience in a SOC or cybersecurity operations role
• Experience with security monitoring tools, SIEM platforms, and incident response processes
• Strong understanding of alert triage, escalation procedures, and incident handling workflows
• Experience analyzing logs, alerts, and telemetry from identity, endpoint, and network systems
• Ability to work in a 24x7 operational environment, including shift‑based coverage
• At least one certification: GCIA, GCIH, CISSP, CEH, or similar

Preferred Qualifications

• Experience with Microsoft Sentinel or Microsoft security platforms
• Relevant cloud security certifications (e.g., AWS security)
• Familiarity with log ingestion pipelines and monitoring data health
• Privacy certifications such as CIPP/US or CIPM
• Experience supporting federal or regulated environments