Required Skills & Experience
10+ years of experience in IT and/or cybersecurity
5+ years of hands-on Security Operations Center (SOC) experience
Strong Senior / L3 SOC Analyst experience
Strong hands-on incident response and security investigation experience
Strong Splunk experience for security investigations and log analysis
Strong hands-on CrowdStrike experience
Experience with threat hunting and proactively identifying suspicious activity
Experience investigating threats across endpoint, network, cloud, email, and firewall environments
Strong understanding of SIEM, EDR, NDR, and IDS/IPS technologies
Ability to independently own complex security incidents from investigation through containment and remediation
Experience improving SOC processes, alerting, playbooks, and incident-response procedures
Nice to Have Skills & Experience
GCIH, GCFA, or GCIA certification
Check Point and/or Palo Alto firewall experience
Tines / SOAR experience
ExtraHop experience
Netskope experience
Microsoft Sentinel and/or Microsoft Defender experience
AWS or Azure security experience
Python, PowerShell, or Bash scripting experience
Experience with security automation
Splunk dashboarding or administration experience
Job Description
Job Overview
We are seeking a Senior SOC Analyst / L3 SOC Analyst to serve as a senior hands-on member of the Security Operations Center. This person will investigate and respond to complex security incidents while helping the organization move from a reactive security model toward a more proactive SOC.
The ideal candidate will have strong hands-on experience with Splunk, CrowdStrike, incident response, and threat hunting and be comfortable independently owning complex investigations. This person will also help strengthen detection capabilities, improve SOC processes and playbooks, reduce false positives, and identify opportunities for automation.
Day to Day
Monitor, triage, and investigate security alerts across the environment
Use Splunk to search, correlate, and analyze security logs during investigations
Investigate endpoint threats and suspicious behavior using CrowdStrike
Own complex incidents escalated beyond L1/L2
Determine the scope and impact of security incidents and coordinate containment and remediation
Conduct proactive threat hunting to identify activity that may not be captured by existing alerts
Investigate phishing, suspicious email activity, endpoint events, network activity, cloud activity, and firewall events
Identify false positives and opportunities to improve alert quality and detection
Improve SOC playbooks, SOPs, and incident-response processes
Identify opportunities to automate repetitive SOC workflows
Participate in the team's on-call rotation (one week a month)
Partner with security and technology teams throughout investigations
Help mature the SOC toward a more proactive, threat-focused security operation