SOC Analyst, Level 3 (Senior)
Location: Irving, TX (Onsite) | Contract
Hands-on Splunk coding experience (SPL detection rules, correlation searches, and alert scripting) is required for this role.
Overview
Our client's Cyber Defense Operations team is seeking a senior Level 3 SOC Analyst to lead complex investigations and build detections in Splunk. What sets this role apart from Level 2 is required coding experience in Splunk, including detection rules, alert scripting, and detection engineering. You'll work a regular US daytime shift alongside the US SOC team, including Level 2 analysts, and an offshore global support team.
Responsibilities
- Design, write, and maintain Splunk detection rules and correlation searches (SPL) based on threat intelligence and attack techniques.
- Script, configure, and tune Splunk alerts to raise detection fidelity and reduce false positives.
- Lead investigation and response for complex and high-severity incidents escalated from Level 2 analysts.
- Perform threat hunting across Splunk data to find activity that existing alerts miss.
- Integrate new log sources and security tools into Splunk, and validate data quality for detection use.
- Mentor Level 2 analysts and review their incident handling, and own runbooks and detection documentation.
- Coordinate with the offshore global support team on handoffs, escalations, and detection changes.
Required Qualifications
- 5-8 years of experience in SOC, incident response, or detection engineering roles, including senior-level incident handling
- Coding experience in Splunk: writing detection rules and correlation searches in SPL, and Splunk alert scripting
- Hands-on detection engineering: building, testing, and tuning alerts end to end
- Deep knowledge of attack techniques (e.g., MITRE ATT&CK), networking, and Windows and Linux internals
- Proven ability to lead incidents and explain findings to technical and non-technical audiences
- Ability to work onsite in Irving, TX on a regular US daytime schedule
Preferred Qualifications
- Splunk Enterprise Security experience; Splunk Core Certified Power User or Splunk Certified Cybersecurity Defense Analyst
- General scripting (Python, PowerShell) for automation and enrichment
- Advanced certifications such as GCIH, GCIA, DA
- Experience with SOAR, EDR, and cloud security tooling integrated into Splunk
- Retail or large multi-site enterprise experience
Pay rate: $60-65/hr (W2). This is a 6-month contract position, onsite in Irving, TX.
