Security Operations Center (SOC) Tier-3 Analyst

Department: Security Operations Reports To: SOC Technical Lead Employment Type: Full-Time, Exempt Work Location: Onsite, Huntsville, Alabama (MAD Security headquarters and 24/7 SOC). Weekday business hours with scheduled on-call. Not remote. Travel Requirements: Occasional travel for client meetings and industry events Position Summary The SOC Tier 3 Analyst is responsible for detection review, engineering projects, threat hunting, and hands-on incident response under the SOC Technical Lead. You take escalations from Tier 2 and make technical rulings, supporting our clients from Huntsville, Alabama. You administer and improve the platform the SOC runs on, with Elastic Security on Elastic Cloud Gov at the center, build AI-assisted workflows with human oversight, and understand the Tier 2 and Tier 1 roles your work supports. Tier 3 at MAD Security is where detection quality is decided and where the next SOC Technical Lead comes from. Primary Responsibilities

• Perform final peer review of detection rules before production; reduce false positives and improve detection effectiveness.
• Execute engineering projects, platform improvements, and tool integrations.
• Administer and maintain Elastic and related SOC tooling.
• Execute incident response under the SOC Technical Lead, including scoping, containment, and evidence handling, and make technical rulings on Tier 2 escalations.
• Create, maintain, and approve threat hunt packs and review hunt reports.
• Build and tune AI-assisted SOC workflows for detection, triage, and response.
• Produce reports for technical and executive audiences.
• Understand the Tier 2 and Tier 1 roles your work supports.

What Success Looks Like in the First 12 Months

• Rules you review go to production against the published standard and false positives on rules you own are down from baseline.
• Engineering projects delivered end to end, documented, and in use.
• Elastic and related tooling administered to standard with issues resolved in-house first.
• Threat hunt pack exists, is re-runnable by Tier 2, and produces detections and readable reports.
• Incident work shows clean scoping, containment, evidence handling, and root cause with recorded rulings.
• You meet the Tier 3 standard and your work is usable by Tier 2 and Tier 1 without rework.

Required Qualifications Experience

• Minimum six years in information security and/or IT, including substantial SOC or NOC experience in an enterprise or MSP/MSSP.
• Expert investigation and incident response skills, including scoping, containment, evidence handling, and root cause analysis.
• Experience authoring, reviewing, tuning, and operationalizing detection content across multiple clients or environments.

Education

• Bachelor's degree in Information Technology, Information Security, Computer Science, or equivalent experience.

Technical Qualifications

• SIEM platform administration, including ingestion, index lifecycle, integrations, and cluster health.
• Scripting in Python, PowerShell, Bash, or similar.
• Familiarity with AI and automation in a SOC, with sound judgment about human oversight.

Required Certifications

• None required. SSCP or CompTIA SecurityX (formerly CASP+) strongly preferred.

Preferred Qualifications

• SSCP or CompTIA SecurityX; GCIH, GCIA, GCFA, GCED, or CISSP as alternates.
• Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
• Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012.
• Vulnerability management and purple team or penetration test liaison experience.

Capabilities and Professional Attributes

• Judgment to make a technical ruling, record the reasoning, and hold it under pressure.
• Strong problem solving and ability to execute autonomously.
• Clear written and verbal communication with technical and executive audiences.
• Integrity: ethical and respectful to clients and team.
• Grit: self-motivates, self-manages, and meets deadlines when faced with competing priorities.
• Customer-centric: partnership with our clients is a win-win scenario.
• Selfless: when one team member succeeds, we all succeed.

Work Environment

• Onsite in Huntsville, Alabama, in an office setting within the 24/7 SOC.
• Weekday business hours, with scheduled on-call.
• Client-facing on technical findings and during incidents.
• Occasional travel for client meetings and industry events.
• Must be a U.S. person; the SOC is staffed by U.S. personnel.
• Physical demands are representative of an office environment.

Why MAD Security

• Mission that matters: our clients build and support what the warfighter depends on, and the SOC is how we protect the systems that enable them.
• A real, in-person 24/7 SOC in Huntsville, Alabama, staffed by U.S. personnel working in the same room, at a time when most of the industry has gone fully remote.
• A company that holds itself to the standard it sells: MAD Security is CMMC Level 2 certified, an authorized C3PAO, and has been a Registered Provider Organization since the program began; our SOC platform runs on Elastic Cloud Gov, which is FedRAMP Moderate authorized.
• A modern platform direction: Elastic Security as the SIEM, detection as code, and agentic triage with human oversight, with the people on the floor shaping how AI is used rather than having it imposed on them.
• Direct access to leadership and real ownership. Standards you write get published and enforced; decisions you make get backed.
• A culture built on ten characteristics of every MAD Security professional, starting with customer service and satisfaction first and expertise as our specialty.

10 Characteristics of Every Professional at MAD Security

• Customer Service and Satisfaction First. Understanding and satisfying our customers is the cornerstone to our success.
• Expertise is our Specialty. Technical competence is essential to our service-oriented structure; we keep our knowledge current.
• Do and Deliver More Than Expected. Deliverables before they are due, of higher quality than anticipated, and under budget.
• Deliver on What We Say and What We Can Do. Before we say we can do something, we make sure we can.
• Communicate Effectively. Clearly, concisely, thoroughly, and accurately, whether verbal or written.
• Follow Exceptional Guiding Principles. High ethical values, good manners, honesty and fairness in all dealings.
• Praise Our Co-workers. Humble and generous in praise for others.
• Share Knowledge. Information is not a limited resource; we learn something new daily and pass it on.
• Express Gratitude. We thank others in a meaningful way.
• Maintain the Right Attitude. Pleasant even during trying times.

Other Duties This job description describes the general nature and level of work to be performed. It is not a comprehensive list of duties, responsibilities, and qualifications. MAD Security, LLC reserves the right to amend responsibilities to meet business and organizational needs, with or without notice. About MAD Security, LLC MAD Security, LLC, founded in 2010, is a veteran-owned cybersecurity provider headquartered in Huntsville, Alabama, and recognized as a Top 250 MSSP by MSSP Alert. We deliver managed security, governance, risk and compliance, and CMMC services to the Defense Industrial Base and other regulated industries, including aviation and aerospace, government contractors, financial institutions, technology service providers, higher education, and manufacturing. Our tagline says it plainly: we defend those that defend the mission.