SOC Analyst

ABOUT US

A Specialty Path to Good Health

Upperline Health is the nation's largest provider group dedicated to lower extremity, wound and vascular care. Founded in 2017 with the ambitious goal of transforming specialty care, Upperline Health is a pioneer in bringing value-based care models into specialty care. Upperline delivers a more efficient path for patients to receive consistent and effective treatment for chronic illnesses.

Triage is temporary.

Treatment is transformative.

Upperline Health providers coordinate patients' care among a team of specialists -- physicians, advanced practice providers, care navigators, pharmacists, dieticians, and social workers for integrated treatment that addresses patients' immediate and long-term health needs.

We put patients at the center of value-based care.

SOC Analyst (Tier 1/2)

Department: IT – Security Operations | Location: Remote (United States) | Reports To: Security Officer | Employment Type: Full-time, exempt

About the SOC Analyst

Upperline Health is looking for a SOC Analyst to join our Security Operations team. You will work directly with the Security Officer to monitor, triage, investigate, and contain security alerts across our Microsoft security stack, Darktrace, and Flare.io. You will protect patient data (PHI/ePHI) for a HIPAA-regulated healthcare organization with clinics and a remote workforce.

This role is created to close two specific gaps: after-hours detection coverage, and the fact that one person currently holds all incident response authority. The SOC Analyst will extend daily monitoring hours, join an on-call rotation, and serve as the named deputy with the privileged access needed to contain an incident if the Security Officer is unavailable.

Schedule: Staggered shift that extends coverage beyond the Security Officer's hours, plus a rotating on-call schedule (evenings/weekends).

What You'll Do

Alert Monitoring & Triage

• Monitor and triage alerts from Microsoft Defender XDR (Defender for Endpoint, Office 365, Identity, and Cloud Apps), Microsoft Entra ID, Darktrace/Identity, Darktrace/Email, and Flare.io
• Work alerts using the ULH Alert Triage Playbook: understand the attacker behavior, follow the investigation steps in order, judge how likely a false positive is, and route each alert to the correct response playbook
• Classify severity on ULH's four-tier scale and meet response targets: Critical (immediate, P1), High (contain within 1 hour), Medium (triage within 4 hours), Low (within 1 business day)
• Own the daily intake queues for Darktrace and Flare.io, which have no Sentinel connector and must be reviewed in their own consoles

Incident Response & Containment

• Run response actions from ULH's incident response playbooks: Account/Identity Compromise, Malware/Ransomware, Worm, Zero-Day, DDoS, Insider Threat, Third-Party/Vendor, and PHI Breach & Notification. Run them in parallel when an incident spans more than one type
• Contain identity threats: disable accounts, reset credentials, revoke sessions and refresh tokens, remove malicious OAuth grants and inbox/forwarding rules, and review MFA methods and device registrations
• Contain endpoint threats: isolate devices in Defender, collect investigation packages, and work with IT/Network Admins on Intune and Cisco Meraki actions
• Respond to phishing, business email compromise (BEC), and wire fraud, and coordinate with Finance on time-critical payment recall
• Escalate to the Security Officer whenever a playbook's 'Escalate If' condition is met. Help engage Fortified, our incident response retainer partner, for Critical incidents, and contain first rather than waiting for Fortified to respond

Evidence Preservation & Compliance

• Preserve evidence before fixing anything, following the Evidence Preservation Playbook: never reboot a suspected compromised device, maintain chain of custody, and capture short-retention cloud and identity logs (such as Entra ID sign-in logs) before they expire
• Refer any suspected PHI/ePHI exposure to the Privacy Officer within 24 hours, and support the HIPAA four-factor risk assessment and 60-day notification timeline
• Write clear, timestamped incident notes and summaries for the Security Officer, leadership, Legal/Compliance, and our cyber insurance carrier

Detection, Hunting & Continuous Improvement

• Write and maintain KQL queries in Microsoft Sentinel and Defender Advanced Hunting for investigations and proactive threat hunting
• Confirm that Sentinel data connectors (Entra ID, Office 365, Defender XDR, Meraki) are enabled and ingesting, and that mailbox auditing (including MailItemsAccessed) is turned on across the tenant
• Check the alert names in the playbooks against live console exports, and tune detections to reduce false positives
• Help maintain playbooks, the IR Contact Directory, and the RACI chart. Help plan and run tabletop exercises and post-incident reviews
• Track vendor/third-party exposure alerts from Flare.io and support the vendor inventory (data held, access paths, BAA status)

Qualifications of the SOC Analyst

• 2-4+ years of experience in a Security Operations Center (SOC) or security analyst role, Tier 1/2 level
• Hands-on experience with Microsoft Defender XDR (Defender for Endpoint, Office 365, Identity, and Cloud Apps) and Microsoft Sentinel, including writing and maintaining KQL queries
• Working knowledge of Microsoft Entra ID, including identity-based containment actions (disabling accounts, resetting credentials, revoking sessions/tokens, reviewing MFA and device registrations)
• Experience with endpoint detection and response (EDR) tools and device isolation/containment procedures
• Familiarity with network detection and response (NDR) or similar tools (e.g., Darktrace) and external threat intelligence/exposure monitoring tools (e.g., Flare.io) is a plus
• Understanding of HIPAA requirements for PHI/ePHI, including breach risk assessment and notification timelines
• Experience responding to phishing, business email compromise (BEC), and wire fraud incidents
• Familiarity with incident response frameworks, playbook-driven response, and evidence preservation/chain-of-custody practices
• Strong written communication skills, with the ability to produce clear, timestamped incident documentation for technical and non-technical audiences
• Willingness and ability to participate in a rotating on-call schedule, including evenings and weekends
• Relevant security certifications (e.g., Security+, GCIH, GSOC, SC-200) are a plus but not required

Tools & Environment

• Microsoft Security: Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra ID, Microsoft Purview, Microsoft Intune
• Detection & Intelligence: Darktrace/Identity, Darktrace/Email, Flare.io
• Network: Cisco Meraki (clinics), remote workforce endpoints
• Partner: Fortified (on-call incident response retainer)

Success in the First 90 Days

• Learn the ULH playbook set and complete a supervised walk-through of every alert category in the Alert Triage Playbook
• Receive privileged access and be documented as the Security Officer's named deputy for identity eviction and containment
• Own the Darktrace and Flare.io intake queues with a defined response SLA
• Go live on the on-call rotation, extending detection coverage beyond current working hours
• Finish verifying Sentinel connectors and mailbox auditing, and report any gaps to the Security Officer

Benefits

Comprehensive benefit options include medical, dental and vision, 401K and PTO.

Compensation

Compensation is commensurate to compensation for similar positions in the region and based on prior training and experience

Job Type: Full-time, exempt