Security Operations Center Analyst

Job DescriptionTec-Refresh is hiring a SOC Analyst to serve as both the first line of defense and a proactive steward of environment health for our nationwide MSP/MSSP customer base. On the reactive side, you'll own alert triage, monitoring, and initial incident response, so our senior engineers can focus on complex investigations and engineering work. On the proactive side, you'll own a recurring cadence of health checks, patch and version currency, baseline auditing, and quarterly customer touchpoints across your assigned tenants. You will be supported throughout by our Level 2/3 engineers, who own escalations and complex remediation, so you are never on an island. The goal is simple: catch the problem during a health check rather than in an alert.\n\nSalary range:$90,000 – $115,000 base, commensurate with experience\nLocation: Greater Boston metropolitan region\n\nWhat You'll Do\nMONITORING & INCIDENT RESPONSE\n• Monitor security alerts and events across multiple customer environments using SIEM, EDR, and related tooling.\n• Triage, validate, and prioritize alerts; investigate potential incidents and rule out false positives.\n• Perform initial incident response — contain, document, and escalate confirmed threats to senior engineers per playbook.\n• Maintain clear, accurate case notes and communicate status to internal teams and customers.\n• Assist with alert tuning, detection improvements, and reducing noise across client tenants.\n• Track and follow up on open items to ensure timely resolution and SLA compliance.\n\nPROACTIVE SERVICES (ENVIRONMENT HEALTH)\n• Run a recurring health cadence across assigned tenants — monthly automated checks, quarterly deep review.\n• Track firmware and software currency across customer firewalls and security tooling (Fortinet, Palo Alto Networks, Cisco Meraki). Flag end-of-support versions, open PSIRT/CVE exposure, and pending vendor advisories.\n• Prepare and execute firewall and security-tool update packages under Tec-Refresh change control — scoped, scheduled in an approved maintenance window, with rollback documented before the window opens.\n• Audit customer environments against configuration baselines and best-practice standards (CIS Benchmarks, vendor hardening guides, Tec-Refresh internal standards). Document drift and drive remediation to closure.\n• Support security and compliance adherence across the customer base — map findings to applicable frameworks (ISO 27001, SOC 2, NIST CSF, CIS Controls, PCI DSS, HIPAA, as relevant per client) and maintain evidence for audit and annual risk review.\n• Build and maintain the quarterly touchpoint deliverable for each assigned account, including a posture summary, open findings, patch and version status, alert trends, and recommended next actions.\n• Participate in quarterly customer review calls alongside the account lead — present the security portion, answer questions, capture follow-ups, and close the loop on prior-quarter commitments.\n\nWhat You Bring\n• 2–4 years in a SOC, IT security, or related technical role (MSP/MSSP experience a plus).\n• Working knowledge of SIEM, EDR/XDR, and common security tooling.\n• Hands-on familiarity with firewall and security platforms such as Fortinet, Palo Alto Networks, or Cisco Meraki.\n• Understanding of network fundamentals, common attack techniques, and the incident response lifecycle.\n• Exposure to configuration baselines (CIS Benchmarks, vendor hardening guides) and formal change-control processes.\n• Strong attention to detail, organization, and the ability to prioritize across many customers and a recurring cadence.\n• Clear written and verbal communication — comfortable presenting findings on customer review calls.\n• Security+ or equivalent certification preferred (or willingness to earn within an agreed timeframe).\n\nNice to Have\n• Experience in a multi-tenant / managed services environment.\n• Familiarity with compliance frameworks (SOC 2, ISO 27001, NIST CSF, PCI DSS, HIPAA) and evidence gathering.\n• Familiarity with MITRE ATT&CK, threat intelligence, or basic scripting (PowerShell, Python).\n• Additional certifications (Network+, CySA+, GSEC, or vendor-specific).\n\nWhy Tec-Refresh\nJoin a growing security team where your work directly protects clients across the country. You'll get hands-on exposure to a wide range of environments and tools, mentorship from experienced engineers, and a clear path to advance into senior analyst or engineering roles.\n\nTec-Refresh, Inc. is an Equal Opportunity Employer. We do not discriminate on the basis of race, color, religion, creed, national origin, ancestry, sex, gender identity or expression, sexual orientation, age, physical or mental disability, genetic information, veteran or military status, pregnancy or pregnancy-related condition, marital status, or any other characteristic protected by applicable federal, state, or local law. This commitment applies to all aspects of employment, including recruitment, hiring, training, promotion, compensation, benefits, and termination. In accordance with the Massachusetts Pay Equity Act, we do not seek or rely on a candidate's salary history when making compensation decisions; instead, we base compensation on the role's requirements and responsibilities.