Security Operations Center (SOC) Analyst

**TWIC Card Required** PLEASE DO NOT APPLY IF YOU DO NOT HAVE AN ACTIVE TWIC CARD. Temporary to Permanent role ***Remote work is NOT an option for this position*** 3–5+ years of hands-on SOC experience in a production enterprise environment. Experience independently performing security monitoring, alert triage, threat hunting, and incident response throughout the incident lifecycle. Strong experience investigating alerts using enterprise SIEM platforms, particularly Splunk, with solid log analysis and security investigation skills. Hands-on experience with EDR/XDR solutions such as Microsoft Defender, CrowdStrike, Carbon Black, SentinelOne, or similar platforms. Experience with Microsoft security technologies, including Microsoft 365, Microsoft Defender, Microsoft Sentinel, and Entra ID/Azure AD, is highly desirable. Ability to investigate phishing, malware, ransomware, identity-based threats, and endpoint security incidents. Experience supporting enterprise environments and the ability to discuss operational metrics, such as the size of the environment, endpoint counts, users supported, and security technologies utilized. Strong understanding of incident response, root cause analysis, threat hunting, and detection engineering. Excellent communication skills with the ability to clearly explain personal contributions, technical investigations, and day-to-day SOC responsibilities during interviews. Please ensure resumes clearly reflect the candidate's actual hands-on experience, technical responsibilities, and accomplishments. Candidates who can demonstrate ownership of investigations and articulate their experience with specific examples have been the strongest performers during the interview process. Role Summary The SOC Analyst is responsible for monitoring, investigating, documenting, and coordinating response to cybersecurity events across enterprise environments. This role is designed for an analyst with 3?5 years of hands-on experience in SOC operations, incident response, phishing investigation, threat monitoring, or related cybersecurity operations. The analyst is expected to communicate clearly, collaborate early with senior cybersecurity personnel and cross-functional teams, and exercise sound judgment during complex or time-sensitive investigations. Essential Functions and Responsibilities Monitor, triage, validate, and investigate security alerts from SIEM, EDR, email security, identity, network, cloud, and other cybersecurity platforms. Analyze suspicious activity, indicators of compromise, malware alerts, account compromise indicators, unauthorized access attempts, phishing emails, smishing messages, malicious links, and business email compromise attempts. Document investigation findings, actions taken, supporting evidence, recommendations, and response activities in designated ticketing or case management systems. Coordinate with senior cybersecurity personnel, IT, OT, email administrators, endpoint teams, identity teams, business stakeholders, and affected users to support investigation, containment, remediation, and user guidance. Participate in incident response activities, including evidence gathering, timeline development, stakeholder coordination, lessons learned, and post-incident improvement efforts. Review threat intelligence, vulnerability disclosures, and security advisories to identify relevant indicators, attacker techniques, and potential impacts to the organization. Conduct proactive threat hunting and recommend detection improvements, correlation rules, alert tuning, and workflow enhancements. Support security control validation, cybersecurity awareness activities, phishing simulations, vulnerability prioritization, operational reporting, and metrics development. Maintain and improve SOC playbooks, standard operating procedures, investigation templates, knowledge articles, and analyst handoff practices. Communicate investigation status, risk, findings, and recommended next steps clearly to technical teams, senior team members, business stakeholders, and end users. Preferred Qualifications Industry certification such as CompTIA Security+, CompTIA CySA+, Microsoft SC-200, Cisco CyberOps Associate, GSEC, GCIH, CEH, or similar cybersecurity certification. Experience writing or modifying SIEM queries, EDR detection logic, threat hunting queries, or basic automation scripts. Knowledge of MITRE ATT&CK, Cyber Kill Chain, NIST incident response concepts, or similar threat and response frameworks. Experience supporting cybersecurity awareness programs, phishing simulations, vulnerability prioritization, remediation tracking, control validation, reporting, or exposure management activities. Interest in mentoring junior analysts, improving SOC processes, and contributing to a collaborative, team-oriented security operations culture. Knowledge, Skills, and Abilities Strong understanding of SOC workflows, incident response concepts, threat intelligence, vulnerability management, and security monitoring fundamentals. Ability to recognize phishing, smishing, business email compromise, malware activity, credential compromise, suspicious user behavior, and common attacker tactics. Strong technical analysis, documentation, prioritization, problem-solving, and customer service skills. Ability to clearly communicate findings, risks, investigation status, and recommended next steps to both technical and non-technical audiences. Ability to collaborate effectively with senior analysts, incident responders, IT, OT, infrastructure, identity, email, endpoint, and business teams. Commitment to continuous learning, adaptability, and improving SOC processes, detections, and response workflows. Work Environment and Physical Demands This role operates in a professional office environment within or outside of an industrial plant environment and routinely uses standard office equipment. The role is primarily sedentary; however, the incumbent must be able to sit and/or stand for a full shift, lift up to 20 lbs. as needed, move throughout office or site locations, and drive to other Company work locations as required. Other Duties This job description is not intended to contain a comprehensive listing of all activities, duties, or responsibilities required of the employee. Duties, responsibilities, and activities may change at any time with or without notice. HSE Roles and Responsibilities Support the policies, efforts, and programs of the Health, Safety and Environmental (HSE) Management System. Actively participate in HSE Management System policies and ensure HSE concerns are prioritized in all activities completed within the incumbents area of responsibility. Overtime Status : Non-Exempt Rate Type : Hourly Target Pay Rate Range : 48.00 USD - 50.00 USD Required Qualifications 3 to 5 years of hands-on experience in a SOC, incident response, threat monitoring, phishing investigation, vulnerability management, or related cybersecurity operations role. Working knowledge of SIEM, EDR, email security, identity security, vulnerability management, and ticketing or case management platforms. Experience with alert triage, log review, investigation documentation, incident validation, and response coordination. Ability to analyze suspicious emails, SMS messages, links, attachments, indicators of compromise, endpoint alerts, user activity, and network or identity-based security events. Strong written and verbal communication skills with the ability to brief senior cybersecurity personnel, coordinate with technical teams, respond professionally to end users, and document findings clearly. Demonstrated ability to collaborate early on complex or high-risk investigations rather than attempting to resolve significant security events in isolation. Ability to manage multiple investigations, tasks, and operational priorities with urgency, accuracy, and follow-through. Bachelors degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or related technical field, or equivalent hands-on cybersecurity experience. #J-18808-Ljbffr Top Talent Central