SOC Analyst

Job Description:
Our client, a large emergency medical services and transportation organization, is seeking a Lead Security Analyst with a strong SIEM engineering background. This role is heavily focused on the engineering side of the SIEM, including log onboarding and data source integration, rather than day-to-day analyst triage. The ideal candidate deeply understands how the SIEM works under the hood and can investigate logs, tables, and data to quickly identify attackers and attack vectors, while also supporting incident response efforts.

Day-to-Day Responsibilities:

• Own the engineering and onboarding of new log sources and data connections into the SIEM (firewalls, EDR, cloud platforms, identity telemetry)
• Maintain a deep understanding of how the SIEM works and how the SOC uses it, ensuring log/data health across sources
• Assist with tuning detection logic and alerts, and support automation efforts to enable rapid response
• Proactively engage technical and non-technical teams to onboard additional logs and maintain log health
• Investigate logs (tables, columns, values) to identify attackers and attack vectors, supporting quick containment
• Support incident response and act as a technically strong partner to the incident commander
• Develop automation and integration scripts to enhance SOC workflows
• Communicate consistently with the team through updates, feedback, and delivery of tangible work product
• Partner cross-functionally with Infrastructure, Compliance, and Operations teams
• Assist with documentation, reporting, runbooks, and SOPs

Minimum Requirements:

• 5 years of security operations experience; 7 years of broad IT experience
• Strong hands-on SIEM engineering background, especially log onboarding and data source integration (Microsoft Sentinel preferred)
• Deep understanding of the mechanics of how a SIEM works and how a SOC uses it
• Deep Microsoft ecosystem expertise, including Azure - considered a critical, non-negotiable component of this role
• Experience assisting with detection tuning, alerting, and automation for rapid response
• Strong PowerShell scripting skills
• KQL (log query language)
• Outgoing, proactive communicator able to work with both technical and non-technical teams
• Consistently engaged team player who provides regular updates and delivers tangible work
• Experience supporting enterprise environments of 35,000 users

• Bash scripting
• Python scripting
• Experience with CrowdStrike or other enterprise EDR platforms
• Experience with Microsoft Copilot for Security or similar AI security tooling
• Familiarity with healthcare or regulated environments (HIPAA, PCI)