Level 3 Soc Analyst - Senior Security Operations

Job Description

\ N

Hybrid | Broward county FL | 24x7x365 SOC

\ N

We are seeking an experienced Level 3 SOC Analyst to serve as a senior technical authority within a 24x7x365 Security Operations Center.

\ N

This is a hands-on technical role, not a people-management position . The Level 3 Analyst will own complex investigations escalated by Level 1 and Level 2 analysts, conduct advanced threat hunting and forensic analysis, improve detection quality, and provide technical mentorship and escalation support to the SOC team.

\ N

The ideal candidate is anexperienced security professional who can independently investigate sophisticated threats, make sound decisions during high-severity incidents, and clearly communicate findings to both technical teams and customers.

\ N

Key Responsibilities

\n

Advanced Investigation & Threat Analysis

\ N

\n
• Own complex security investigations escalated from Level 1 and Level 2 analysts.
\ N
• Determine incident scope, impact, root cause, and disposition.
\ N
• Investigate advanced threats including:
\ N
• Ransomware and pre-ransomware activity
\ N
• Advanced persistent threats (APTs)
\ N
• Business Email Compromise (BEC)
\ N
• Identity-based attacks
\ N
• Insider threats
\n
• Reconstruct attack timelines across endpoint, identity, network, email, and cloud telemetry.
\ N
• Perform forensic analysis involving logs, host artifacts, identity activity, memory/disk artifacts, and network traffic.
\ N
• Produce technically defensible findings suitable for customers and regulated environments.
\ N

\n

Security Technology & Detection Stack

\ N

Work across enterprise security technologies including:

\ N

\n
• Huntress MDR/EDR/ITDR
\ N
• Google Chronicle / Google SecOps
\ N
• CrowdStrike
\n
• Microsoft Defender
\ N
• Microsoft 365
\n
• Microsoft Entra ID
\ N
• SIEM/SOAR technologies
\ N
• Threat intelligence platforms
\ N
• Endpoint and network telemetry
\ N

\n

Comparable experience with platforms such as Microsoft Sentinel or Splunk is also highly relevant.

\ N

Incident Response

\n

\ N
• Serve as the senior technical escalation point during high-severity security incidents.
\ N
• Coordinate response activities with SOC leadership, infrastructure/NOC teams, cybersecurity teams, and external partners.
\ N
• Confirm true-positive incidents and identify indicators of compromise.
\ N
• Coordinate containment activities with infrastructure teams.
\ N
• Support major incident response and incident command.
\ N
• Work against defined severity-based response requirements and MTTA, MTTD, and MTTR objectives.
\ N
• Identify incidents thatmay trigger contractual or regulatory notification requirements and escalate appropriately.
\ N
• Lead technical post-incident reviews and identify required detection or process improvements.
\ N

\n

Threat Hunting & Proactive Defense

\ N

\n
• Conduct structured, hypothesis-driven threat hunts across customer environments.
\ N
• Search for Indicators of Compromise (IOCs) and Indicators of Attack (IOAs).
\ N
• Perform retrospective analysis against historical telemetry.
\ N
• Use threat intelligenceand MITRE ATT&CK to guide investigations.
\ N
• Identify gaps in existing detection coverage.
\ N
• Help improve overall threat-detection capabilities.
\ N

\n

Detection Engineering & Tuning

\ N

\n
• Analyze detectionrules, correlation logic, raw logs, and normalized security data.
\ N
• Investigate false positives, detection gaps, parser failures, and missing telemetry.
\ N
• Develop evidence-based recommendations for detection-rule improvements.
\ N
• Work with SIEM/SOAR anddetection-engineering teams on:
\ N
• Detection tuning
\n
• Parser and schema mapping
\ N
• Use-case development
\ N
• Detection scoring
\n
• Log ingestion
\ N
• Validate that detectionchanges continue to identify the threats they were designed to detect.
\ N
• Identify repetitive investigation, enrichment, triage, and containment processes that can be automated.
\ N
• Support the developmentof security automation and SOAR workflows.
\ N

\n

Mentorship & Technical Leadership

\ N

\n
• Provide technicalguidance and escalation support to Level 1 and Level 2 SOC Analysts.
\ N
• Review investigations and case documentation for technical quality.
\ N
• Help junior analysts develop stronger investigation and incident-response skills.
\ N
• Develop and maintain:
\ N
• Incident-response playbooks
\ N
• Runbooks
\n
• Standard Operating Procedures (SOPs)
\ N
• Support SOC onboarding,tabletop exercises, and incident-response simulations.
\ N

\n

This position does not have direct reports. Technical mentorship is a core responsibility.

\ N

Customer Communication & Documentation

\ N

\n
• Independently produce professional incident reports covering:
\ N
• Incident timeline
\n
• Root cause
\ N
• Scope and impact
\n
• Actions taken
\ N
• Recommended remediation
\ N
• Clearly communicate complex security findings to technical and non-technical audiences.
\ N
• Participate in customerincident calls when required.
\ N
• Maintain accurate investigation documentation throughout the incident lifecycle.
\ N
• Contribute technical security findings and trends to customer service reviews and quarterly business reviews.
\ N
• Participate in formal SOC shift handoffs to ensure continuity of open investigations.
\ N

\n

Required Experience

\ N

\n
• 5+ years of SOC, cybersecurity operations, incident response, or related security experience.
\ N
• Demonstrated ownership of complex or escalated security investigations.
\ N
• Hands-on experience with incident response, forensic analysis, and threat hunting .
\ N
• Experience working withmodern SIEM/SOAR and EDR/MDR platforms .
\ N
• Strong understanding ofendpoint, network, identity, and cloud security telemetry.
\ N
• Experience investigating Microsoft 365 and Microsoft Entra ID environments.
\ N
• Experience with at least one major cloud platform:
\ N
• Azure
\n
• AWS
\ N
• Google Cloud Platform
\ N
• Strong working knowledge of MITRE ATT&CK .
\ N
• Ability to independently investigate complex security incidents with limited supervision.
\ N
• Experience mentoring orproviding escalation support to junior SOC analysts.
\ N
• Strong written and verbal English communication skills.
\ N

\n

Experience within a multi-client MSSP, MSP, MDR, or managed-security environment is strongly preferred.

\ N

Technical Skills

\n

Candidates should have strong experience in several of the following areas:

\ N

\n
• SIEM / SOAR
\n
• Google Chronicle / Google SecOps
\ N
• Microsoft Sentinel
\n
• Splunk
\ N
• Huntress
\n
• CrowdStrike Falcon
\ N
• Microsoft Defender
\n
• EDR / MDR / XDR
\ N
• Incident Response
\n
• Digital Forensics
\ N
• Threat Hunting
\n
• Detection Engineering
\ N
• Malware Analysis
\n
• Threat Intelligence
\ N
• Microsoft 365
\n
• Entra ID
\ N
• Azure / AWS / GCP
\n
• MITRE ATT&CK
\ N
• Log and network analysis
\ N
• Python and/or PowerShell
\ N
• Security automation
\ N
• ConnectWise Manage or similar PSA/ticketing platforms
\ N

\n

Knowledge of security frameworks and regulatory requirements including NIST, CIS, ISO 27001, HIPAA, PCI-DSS, and GLBA is highly desirable.

\ N

Education

\n

\n
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field preferred.
\ N
• Equivalent professionalcybersecurity experience will also be considered.
\ N

\n

Certificatio