Security Operations Center Analyst

Required Skills & Experience

7-10 years of experience in a SOC or cybersecurity operations role.

Proficiency with Secureworks Taegis and Microsoft Defender (Endpoint, Identity, Cloud), including rule tuning, log analysis, and case management.

Experience with SIEM tools (e.g., Splunk, QRadar, Elastic Stack) and SOAR platforms.

Strong understanding of TCP / IP, DNS, HTTP / S, and other network protocols.

Familiarity with endpoint detection tools (e.g., Defender for Endpoint), IDS / IPS, and vulnerability scanners (e.g., Nessus, Qualys).

Scripting skills in Python, Bash, or PowerShell for automation and data parsing.

Nice to Have Skills & Experience

Bachelor’s degree in Cybersecurity, Computer Science, or related field.

Certifications such as CompTIA Security+, GIAC (GCIH, GCIA), CEH, or Microsoft Security certifications (e.g., SC-200, SC-300).

Prior experience supporting federal or financial clients.

Experience with red / blue / purple team exercises and threat hunting.

Job Description

We are seeking a Security Operations Center (SOC) Analyst with hands-on experience in Secureworks Taegis and Microsoft Defender (Endpoint, Identity, and Cloud) to join our cybersecurity team. This role is critical for monitoring, analyzing, and responding to security threats across cloud and hybrid environments. The ideal candidate will thrive in high-pressure situations, collaborate across teams, and leverage SIEM / SOAR capabilities to enhance threat detection and response.

Key Responsibilities

Monitor and triage security alerts using Secureworks Taegis and Microsoft Defender, including detection rule authoring and alert enrichment.

Investigate incidents across cloud, network, and endpoint environments using Secureworks case management and Defender telemetry.

Develop and maintain log ingestion pipelines using tools like Cribl or Logstash for Secureworks integration.

Collaborate with Tier-2 / 3 analysts and threat intelligence teams to refine detection rules and reduce false positives.

Participate in incident response activities, including containment, eradication, and recovery.

Create and maintain SOC playbooks and automation workflows using Secureworks SOAR and Microsoft security automation capabilities.

Conduct packet analysis, malware triage, and forensic investigations as needed.

Stay current on threat landscapes, compliance standards (e.g., MITRE ATT&CK, GDPR, PCI-DSS), and emerging security technologies.