Security Operations Center Analyst L3

The Security Operations Center (SOC) Analyst L3 is a critical member of the Information Security team responsible for monitoring, detecting, analyzing, and responding to cybersecurity threats across the organization's environment. This role serves as the frontline defense against adversarial activity, operating within a 24×7 detection-first SOC model. The primary responsibility of this position is the security alert workflow — the continuous triage, investigation, and disposition of security alerts and events generated across our security tooling ecosystem. Beyond queue operations, this role offers structured growth into threat hunting, detection engineering, incident response, vulnerability management, insider risk management and cross-functional InfoSec support. This is a shift-based role supporting 24×7 operations; schedules may include evenings, overnight shifts, weekends, and holidays as business needs require.

Responsibilities

Monitor, detect, analyze, and respond to cybersecurity threats across the organization's environment; Perform security alert workflow including triage, investigation, and disposition of security alerts; Oversee detection queue health and ensure consistent SLA adherence; Conduct advanced investigations of complex, multi-stage attacks across endpoint, identity, network, cloud, and third-party environments; Act as primary escalation point for major incidents; Author and maintain SOC documentation including playbooks, SOPs, runbooks, training content, and detection standards; Support incident response efforts including evidence gathering, containment actions, and timeline construction; Participate in threat hunting missions and document findings; Contribute to development, testing, and refinement of detection rules in SIEM; Review vulnerability scan results and assist in triaging findings; Support review and triage of insider risk alerts; Provide cross-functional InfoSec support to other teams

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or equivalent practical experience; 2–4+ years of experience in a SOC, IT security, or related technical role depending on level applied for; Familiarity with enterprise IT environments including Windows/Linux systems, Active Directory, and cloud platforms (Azure, AWS, GCP); Experience with security tools such as SIEM (Sentinel, Splunk), EDR (CrowdStrike, SentinelOne, Defender), or email security platforms; Proficiency in log analysis and event correlation across multiple data sources; Working knowledge of attacker TTPs mapped to the MITRE ATT&CK framework; Understanding of network protocols, traffic analysis, and common attack vectors; Familiarity with scripting languages (Python, PowerShell, KQL/SPL) for investigation and automation; Experience with case management platforms (ServiceNow, Jira, or similar ITSM tools); Understanding of the NIST CSF, incident response lifecycle, and the cyber kill chain model; Strong analytical and critical-thinking skills with high attention to detail; Clear and concise written and verbal communication, including to non-technical stakeholders; Ability to remain composed and effective under pressure during active security incidents; Team-oriented and collaborative with a proactive, security-first mindset; Ability to approach security challenges with genuine curiosity and a questioning attitude, consistently digging deeper to understand the 'why' behind alerts, behaviors, and anomalies rather than accepting surface-level conclusions

Nice to have

CompTIA Security+, CySA+, or equivalent foundational security certification; Microsoft SC-200 (Security Operations Analyst) or AZ-900/AZ-500; EC-Council CEH, SANS GCIA/GCIH, or GREM (preferred for L3)