Position Title:
Threat Management Specialist (Tier 2 SOC Analyst)
Location:
Morrisville, NC
Clearance Requirements:
Public Trust (Ability to Obtain)
Position Status:
Full-Time | Contract
Pay Rate:
Competitive, based on qualifications
Position Description:
We are seeking Threat Management Specialists (Tier 2) to support a 24x7 Cyber Security Operations Center (CSOC). In this role, you will perform advanced incident analysis, threat detection, and response activities by correlating data across network, endpoint, cloud, and email security platforms.
Tier 2 Analysts serve as escalation points for Tier 1, perform deep-dive investigations, and provide subject matter expertise in network-based attacks, intrusion methodologies, and threat intelligence. You will also contribute to the continuous improvement of SOC operations through automation, SOAR, and AI/ML-driven detection capabilities.
This position is ideal for security analysts who enjoy hands-on investigation, technical problem-solving, and applying modern security tooling to real-world threats.
Shift Details (Multiple Openings):
Position 1
Position 2
Key Responsibilities:
Perform Tier 2 incident analysis by correlating alerts, logs, and telemetry from multiple security platforms
Analyze network traffic to identify intrusions, exploits, and anomalous behavior
Investigate and respond to security incidents using established playbooks and SOPs
Provide subject matter expertise on network-based attacks, IDS/IPS, and intrusion techniques
Recommend and tune detection mechanisms for exploits and malicious activity
Escalate complex or high-impact incidents to senior threat management or response teams
Execute response actions and advise on containment and remediation strategies
Leverage AI/ML-based tools to improve detection accuracy, automate triage, and enhance threat intelligence
Analyze and operationalize threat intelligence to assess risk and adapt defenses
Manage and respond to email-based threats using Proofpoint
Configure and investigate security events using Splunk, including alert creation and log analysis
Monitor and analyze network activity using Cisco Firepower
Deploy and manage SentinelOne agents and investigate endpoint alerts
Monitor and respond to alerts across platforms such as:
Microsoft Defender XDR (Endpoint, Office 365, Cloud Apps)
Azure Entra ID
Google Cloud Security Command Center (SCC)
Support SOC automation and SOAR initiatives, identifying opportunities to improve efficiency and response times
Stay current on emerging threats, threat actors, and cybersecurity trends
Required Skills & Education:
8–12 years of relevant cybersecurity or IT security experience
Bachelor’s degree in a related field (or equivalent experience in lieu of degree)
3+ years of IT security experience, with exposure to AI/ML or automation initiatives
2+ years of hands-on network traffic analysis experience
Strong understanding of:
TCP/IP fundamentals
Network-level exploits and intrusion techniques
IDS/IPS architectures, signatures, and anomaly-based detection
Threat management and incident response workflows
Experience with cloud security platforms (AWS, Azure, and/or Google Cloud Platform)
Hands-on experience with SOAR platforms and security automation
Familiarity with applying AI/ML techniques in a SOC environment, including:
Experience working with large datasets (logs, network traffic) for analysis and feature extraction
Strong communication, documentation, and collaboration skills
Ability to work independently and make sound decisions in a high-tempo environment
Preferred Certifications:
Never miss an opportunity! Create an alert based on the job you applied for.
