Amtex Systems Inc is an information technology and talent solutions company offering talent and BI consulting to the companies in US for over 25 years.
Our solutions are designed to fill resource gaps, by providing the right candidates who deliver value to the organization. Our propensity to nurture and build strong relationships with our clients helps us better understand their business demands and gives us the ability to provide services that are on time and rise above the rest.
2 days a week onsite in Atlanta, GA
Rate: $42/hr on W2 (or) 48/hr on C2C
3: Services to be Performed
Contractor shall provide a senior SOC analyst who will perform the following services with minimal supervision and who shall be accountable for the quality and timeliness of the resulting work product.
Role Level
The role is a senior analyst position: stronger than an entry-level or intermediate analyst, and able to handle escalations independently, make sound risk-based recommendations, and mentor junior staff. Candidates are expected to identify improvement opportunities in detection, hunting, and automation on their own initiative. Hands-on implementation of those improvements is valued and expected where the candidate has the skills, within Cox change-control and approval processes.
1. Falcon Complete Escalation Management
1.1 Serve as Cox's primary technical responder to CrowdStrike Falcon Complete escalations, validating activity, providing environmental context, and driving remediation to closure within agreed response times.
1.2 Independently triage and investigate detections in the Falcon console (e.g., process trees, host timelines, Event Search, Real Time Response) to determine scope, root cause, and business impact.
1.3 Evaluate the quality of Falcon Complete escalations, containment, and remediation actions; identify false positives, missed context, and service gaps; and raise them with the MSSP and Cox SOC leadership.
1.4 Maintain escalation contacts, exclusion and exception handling, and escalation criteria in coordination with Cox SOC leadership.
2. Incident Response
2.1 Lead investigation and response for low- to moderate-severity incidents, and provide hands-on support to incident response leadership on major incidents.
2.2 Scope incidents across endpoint, identity, cloud, and network telemetry, and recommend containment, eradication, and recovery actions.
2.3 Produce incident documentation and after-action reports that include root cause and prioritized corrective actions.
2.4 Coordinate with IT, network, cloud, application, legal, and HR stakeholders during investigations.
3. Threat Hunting, Detection Improvement, and Intelligence
3.1 Identify and document threat hunting opportunities and hypotheses, mapped to MITRE ATT&CK, and conduct hunts using Falcon Event Search and related tools. Hunting depth is expected to be commensurate with the role level described below.
3.2 Identify detection gaps, noisy alerts, and tuning opportunities, and recommend specific changes to detections, exclusions, and alert logic. Where qualified and approved by Cox SOC leadership, design, test, and implement those changes.
3.3 Incorporate CrowdStrike threat intelligence and other approved intelligence sources into analysis, assessing relevance to Cox's environment.
3.4 Track emerging threats and indicators of compromise (IOCs), and recommend proactive actions to leadership.
4. Telemetry, Sensor Health, and Visibility
4.1 Review and analyze telemetry from endpoint, identity, cloud, and network sources.
4.2 Identify sensor coverage gaps, unhealthy or outdated sensors, and prevention policy misconfigurations, and drive remediation with the owning teams.
4.3 Validate data ingestion, parsing, and normalization in Falcon Next-Gen SIEM and other monitoring platforms.
4.4 Identify logging gaps and recommend onboarding priorities.
5. Security Improvement, Automation, and Advisory
5.1 Deliver written, prioritized recommendations to improve detection, prevention policy, configuration, and process, with supporting risk rationale.
5.2 Perform periodic Falcon platform health and posture reviews against CrowdStrike best practices.
5.3 Identify and document automation opportunities, including Falcon Fusion SOAR workflows, that reduce manual effort and response time. Where qualified and approved by Cox SOC leadership, build and test workflows. Workflows that take automated response actions require peer review and Cox approval before production use.
5.4 Assess the effectiveness of SOC tooling and MSSP services and recommend changes.
6. Reporting and Metrics
6.1 Contribute to daily, weekly, and monthly SOC operational reports.
6.2 Track and report metrics such as mean time to acknowledge and respond, escalation volume and quality, false-positive rates, MSSP performance, and detection coverage.
6.3 Analyze incident and threat trends and present findings and recommendations to SOC leadership.
7. Playbooks, SOPs, and Knowledge Management
7.1 Follow established SOC workflows and response procedures.
7.2 Author, review, and maintain SOC playbooks, SOPs, and knowledge base content.
7.3 Identify process gaps and recommend or implement approved improvements.
8. Collaboration, Liaison, and Mentorship
8.1 Act as the senior technical liaison between the Cox SOC, Falcon Complete, and other external partners.
8.2 Serve as an escalation point for junior SOC analysts, and coach and review their investigations.
8.3 Communicate findings clearly to both technical and executive audiences.
8.4 Collaborate with engineers, threat hunters, and Tier 3 analysts on complex cases.
9. On-Call Coverage and Work Location (Requirements)
9.1 On-Call: Participation in the Cox SOC on-call rotation is a requirement of this engagement. Contractor personnel shall respond to Falcon Complete escalations and critical incidents outside normal business hours per the following: rotation frequency [Cox to define]; acknowledgement time [Cox to define]; remote access and equipment requirements [Cox to define]; on-call compensation and billing terms [to be agreed in the contract].
9.2 Support incident response during off-hours and surge events, including proper handoff of open items at the end of each on-call period.
9.3 Hybrid Work Location: Contractor personnel shall work on-site at [Cox office location] approximately two (2) days per week, as scheduled by Cox SOC leadership, with the remaining days remote. On-site presence is a requirement of this engagement; candidates unwilling or unable to meet it will not be considered.
Minimum Qualifications (Required)
- 5+ years of experience in security operations, incident response, or threat detection.
- Demonstrated hands-on, production experience with the CrowdStrike Falcon platform, including investigating detections and working escalations in the Falcon console. General working knowledge across the platform is required; expert-level depth in every module is not.
- Active CrowdStrike Certified Falcon Responder (CCFR) certification, or attainment within 60 days of start at Contractor’s expense.
- Working knowledge of MITRE ATT&CK, Windows and Linux internals, and common Active Directory / Entra ID attack techniques.
- Proven ability to work independently on escalations and to communicate findings and recommendations clearly in writing.
- Ability to meet the on-site (hybrid) and on-call requirements in Section 9.
Preferred Qualifications
- Additional CrowdStrike certifications: Falcon Hunter (CCFH), Falcon Administrator (CCFA), or SIEM Analyst (CCSA).
- Experience with Falcon Next-Gen SIEM queries and detections, Falcon Fusion SOAR, Identity Protection, or Falcon Cloud Security.
- Scripting experience (Python or PowerShell).
- Industry certifications such as Security+, CySA+, or GIAC (e.g., GCIH, GCFA), or equivalent demonstrated experience. Not required.
- Prior experience as the customer-side counterpart to an MDR provider.
