SOC THREAT DETECTION & INCIDENT RESPONSE ANALYST
Job Title: SOC Threat Detection & Incident Response Analyst
Location: Remote
Position Type: Full-Time / Contract-to-Hire
Operational Shift: Monday – Friday, 7:00 AM – 6:30 PM PST (Coverage shift model)
1. Role Overview
Technet is seeking a SOC Threat Detection & Incident Response Analyst to provide active security monitoring, threat detection, incident triage, and response for a critical energy-sector utility billing and data management platform.
In this role, you will be responsible for active triage and correlation across CrowdStrike Falcon, a centralized Wazuh SIEM, AWS-native security services (GuardDuty, Security Hub, WAF), and application middleware. You will execute incident response actions and proactive threat hunts in strict alignment with utility emergency operations and incident response frameworks (CEOP/CIRP).
2. Technical Stack & Systems Monitored
- Detection & SIEM Tools: Wazuh SIEM Dashboard & Correlation Engine, CrowdStrike Falcon (Falcon Console, FDR / Streaming API Telemetry).
- Cloud Security Telemetry: Amazon GuardDuty, AWS Security Hub, AWS WAF, AWS CloudTrail, VPC Flow Logs, Route 53 Resolver logs.
- Application & Data Tiers: Amazon RDS SQL Server audit logs, Windows Event Logs / IIS web logs, Dell Boomi middleware logs, GoAnywhere MFT transfer logs, Salesforce CRM connector logs.
- Posture & Vulnerability Feeds: Wazuh SCA (Security Configuration Assessment), AWS Systems Manager (SSM) vulnerability findings, Containerized Prowler daily compliance reports.
- Operational Frameworks: SOC 2 Type II controls, NIST CSF, and NIST 800-53.
3. Key Responsibilities
- Active SOC Monitoring & Triage: Monitor cloud, endpoint, network, and application security alerts Monday through Friday (7:00 AM – 6:30 PM PST), adhering to strict SLAs (≤ 15 minutes for Critical severity; ≤ 1 hour for High severity).
- Multi-Stage Threat Correlation: Correlate disparate signals across CrowdStrike Falcon endpoint detections, AWS GuardDuty anomalies, CloudTrail management events, IIS web server logs, and RDS SQL Server audit records to identify complete attack chains.
- Threat Hunting: Conduct hypothesis-driven and intelligence-driven threat hunts focusing on cloud credential hijacking, IAM privilege escalation, impossible-travel anomalies, MFA bypass, and unauthorized data staging/exfiltration.
- Integration Edge & File Transfer Monitoring: Perform targeted monitoring of GoAnywhere MFT, Dell Boomi, and external data exchanges (PG&E feeds) for anomalous file transfers, off-hours execution, or unauthorized outbound connections.
- Incident Response & Containment: Execute response playbooks aligned with enterprise CEOP and CIRP frameworks. Perform host isolation recommendations, credential revocation coordination, and initial evidence preservation.
- Vulnerability & Posture Prioritization: Review daily vulnerability scan outputs from Wazuh SCA/SSM and posture findings from Prowler; prioritize findings by business impact and exploitability, and track remediation with engineering teams.
- Reporting & Governance: Assist in preparing monthly security posture reviews, threat intelligence summaries, and quarterly executive risk dashboards.
4. Required Qualifications & Technical Skills
- Experience: 3+ years of hands-on experience in a Security Operations Center (SOC), Threat Analysis, or Incident Response role.
- Tooling Proficiency: Direct experience analyzing alerts and querying logs within CrowdStrike Falcon, Wazuh (or ELK/OpenSearch/Splunk SIEM), and AWS Security Hub / GuardDuty.
- Cloud & Identity Threat Knowledge: Practical experience analyzing AWS CloudTrail logs, detecting IAM abuse patterns, credential spraying, and web application attack vectors (OWASP Top 10, AWS WAF rules).
- Log Analysis Skills: Strong ability to inspect and analyze raw logs from Windows Event Viewer, IIS web servers, database audit logs (SQL Server), and API/MFT transactional logs.
- Incident Response Execution: Understanding of formal incident response methodologies (containment, eradication, recovery) and playbook execution.
- U.S. Data Residency Requirement: Must reside and work exclusively within the United States.
5. Preferred Qualifications & Certifications
- CompTIA CySA+, Security+, or GIAC Certified Incident Handler (GCIH)
- GIAC Certified Enterprise Defender (GCED) or GIAC Cloud Forensics (GCFA)
- Certified Information Systems Security Professional (CISSP) or CISM
- AWS Certified Cloud Practitioner or AWS Certified Solutions Architect Associate
- Prior experience in utility, public power, or critical infrastructure operations.
Never miss an opportunity! Create an alert based on the job you applied for.