Senior SOC Analyst (L3) Exp. with Palo Alto, Cortex, Fortinet, Tenable, Rapid7, Cribl, EDR/XDR & Active Certifications - Night Shift || G.C / U.S.C
6+Months
Remote
W2 Only (No C2C)
Role Summary:
- Senior-level SOC Analyst responsible for complex incident detection, investigation, and response across endpoint, network, identity, and cloud. Acts as the primary escalation point for Tier 1/2, drives threat hunting and detection engineering, and mentors the broader SOC team.
Work Schedule:
- Shift: 6:00 PM–6:00 AM local time
- Model: Hybrid with rotating nights, weekends, and holidays (24x7x365 coverage)
Core Responsibilities:
- Lead triage and investigation of high-severity/complex security incidents; coordinate containment, eradication, and recovery activities.
- Serve as L3 escalation for Tier 1/2; provide technical guidance and approve incident closures/escalations.
- Conduct proactive threat hunting across EDR/XDR, network, identity, and cloud telemetry leveraging MITRE ATT&CK.
- Develop, tune, and validate detections and correlation logic in SIEM/XSIAM; reduce false positives and improve detection fidelity.
- Perform root-cause analysis and create actionable remediation plans with cross-functional teams.
- Build and maintain response playbooks, SOPs, and knowledge base articles; contribute to training and mentoring pathways.
- Support backup/recovery validation and backend SOC tooling troubleshooting as needed.
- Produce clear incident documentation, executive-ready summaries, and technical recommendations.
Required Qualifications:
- 5–8 years of hands-on SOC or Cybersecurity operations experience, including advanced incident response and security monitoring.
- Demonstrated expertise with SIEM/XSIAM, EDR/XDR, and SOAR workflows; strong analytical and investigative skills.
- Proven experience performing threat hunting, detection engineering/tuning, incident escalation, and root-cause analysis.
- Familiarity with MITRE ATT&CK and NIST-aligned processes and playbooks.
- Strong communication skills for cross-functional coordination and mentoring.
- Willingness to work night shifts in a rotating 24x7 environment.
Preferred Qualifications:
- Practical experience with: Palo Alto (including Cortex), Fortinet, Tenable, Rapid7, Cribl, and major EDR/XDR platforms.
- Broader knowledge across network, identity, and cloud security controls and telemetry.
- Scripting/automation for detection and response (e.g., Python, PowerShell) and query languages (e.g., KQL, SPL, SQL, regex).
Certifications:
- Active, relevant certifications strongly preferred: GIAC (e.g., GCIH, GCIA, GCFE, GCDA), CISSP, or equivalent.
Tools and Platforms:
- SIEM/XSIAM, SOAR, EDR/XDR
- Palo Alto, Cortex, Fortinet
- Tenable, Rapid7
- Cribl and related log/telemetry pipelines
Deliverables and Success Criteria:
- Complete incident investigation reports with validated containment/eradication steps and RCA.
- Measurable improvements to detection content and response playbooks (e.g., reduced false positives, improved MTTD/MTTR).
- Published knowledge articles, SOPs, and training materials for SOC staff.
- Documented escalations and technical guidance to partner teams.
- Contributions to SOC process optimization and monitoring coverage enhancements.
- Final deliverables and acceptance criteria to be confirmed with the engagement team.
