SOC Analyst Level 3

We are seeking an experienced Level 3 SOC Analyst to join our 24x7x365 Security Operations Center. This role is responsible for taking escalated security alerts from initial triage through investigation, determining scope and impact, documenting findings, and reaching a defensible conclusion.

The Level 3 Analyst will work across multiple client environments and security platforms while providing day-to-day guidance to Level 1 analysts, improving detection quality, and supporting incident response activities.

This is an ideal opportunity for a security professional who enjoys hands-on investigation, threat hunting, detection engineering, and solving complex security incidents rather than simply working an alert queue.

What You'll Do

Security Investigation & Analysis

• Own security investigations escalated from Level 1 through resolution.
• Determine incident scope, impact, root cause, and final disposition.
• Correlate evidence across endpoint, identity, email, and network telemetry.
• Perform practical forensic analysis, including:
• Log correlation
• Endpoint artifact analysis
• Email header analysis
• Identity and sign-in investigation
• Document investigation findings clearly and thoroughly.
• Work across multiple security platforms and customer environments.

Incident Response & Escalation

• Investigate incidents according to severity-based response requirements and defined MTTA, MTTD, and MTTR objectives.
• Coordinate containment activities with the appropriate infrastructure/NOC teams.
• Escalate suspected breaches, multi-host or multi-tenant activity, and other high-impact incidents to Level 3 or SOC leadership.
• Support major incident response under the direction of senior security personnel.
• Contribute findings and recommended follow-up actions to post-incident reviews.

Detection Tuning & Security Operations

• Identify recurring false positives and drive improvements to detection quality.
• Maintain detection-tuning and false-positive tracking for assigned environments.
• Build evidence-based recommendations for detection rule changes.
• Evaluate the impact of tuning changes on detection coverage across multiple customer environments.
• Validate that detection rules continue to identify the intended threat conditions following changes.
• Identify and escalate parser, log-source, and data-ingestion issues that may impact security visibility.

Threat Hunting

• Conduct threat hunts based on defined hypotheses across customer environments.
• Develop new hunt hypotheses based on emerging threats and observed activity.
• Map suspicious activity to MITRE ATT&CK techniques.
• Use detection coverage and threat intelligence to guide investigations.

Level 1 Mentorship & Team Support

• Provide day-to-day escalation support and technical guidance to Level 1 SOC Analysts.
• Validate incident classifications and escalation decisions.
• Review Level 1 case documentation for quality and completeness.
• Support onboarding and development of junior analysts.
• Contribute to SOC playbooks, runbooks, procedures, and knowledge documentation.

Customer Communication & Reporting

• Prepare clear incident summaries covering:
• What happened
• Scope and impact
• Actions taken
• Recommended remediation
• Participate in customer calls when needed.
• Maintain accurate and complete case documentation.
• Contribute incident trends and security observations to customer reviews and reporting.
• Participate in formal shift handoffs to ensure open investigations and follow-up items are not missed.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field or equivalent professional experience .
• 3–5 years of hands-on SOC or security operations experience.
• Demonstrated experience with security alert investigation, incident response, and threat detection.
• Experience working with at least one SIEM and one EDR platform .
• Ability to independently investigate security incidents without step-by-step direction.
• Practical understanding of incident response methodology, including triage, scoping, containment support, evidence handling, and documentation.
• Working knowledge of MITRE ATT&CK .
• Experience investigating Microsoft 365 and Microsoft Entra ID environments.
• Strong written and verbal communication skills.
• Ability to manage multiple concurrent investigations in a fast-paced, 24x7 environment.
• Strong analytical and problem-solving skills.
• Ability to recognize when an incident requires escalation.

Technical Environment

Experience with one or more of the following is highly desirable:

SIEM / SOAR

• Google Chronicle
• Other enterprise SIEM/SOAR platforms

EDR / MDR

• Huntress
• CrowdStrike
• Microsoft Defender
• Other enterprise EDR/XDR platforms

Identity & Cloud

• Microsoft 365
• Microsoft Entra ID
• Azure
• AWS
• Google Cloud Platform

Security Operations

• Incident Response
• Threat Hunting
• Detection Engineering
• MITRE ATT&CK
• Digital Forensics
• Email Security
• Endpoint Security
• Network Security

Automation

• Python
• PowerShell

Ticketing / PSA

• ConnectWise Manage or similar ticketing/PSA platforms

Certifications

Expected:

• CompTIA Security+
• CompTIA CySA+

Preferred defensive security certifications include:

• Blue Team Level 1 (BTL1)
• Blue Team Level 2 (BTL2)
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• Hack The Box Certified Defensive Security Analyst (CDSA)
• CyberDefenders Certified CyberDefender (CCD)

Additional certifications valued:

• CompTIA PenTest+
• CEH
• eJPT
• Microsoft SC-200
• CrowdStrike certifications
• Google Cloud security certifications

What We're Looking For

The successful candidate will be someone who:

• Can independently take an escalated alert from investigation through conclusion.
• Thinks beyond closing tickets and looks for ways to improve detection quality.
• Understands when to resolve an incident and when to escalate.
• Can clearly explain technical findings to both technical and non-technical audiences.
• Remains composed during active security incidents.
• Enjoys mentoring and supporting Level 1 analysts.
• Is highly organized and able to prioritize multiple investigations.
• Is detail-oriented and documents work as the investigation progresses.
• Can adapt quickly as threats, technologies, and customer environments change.
• Has strong written and verbal English communication skills.