SOC Analyst Level 3

Published: 6/14/2022

Real Estate

Job Description

We are seeking an experienced Level 3 SOC Analyst to join our 24x7x365 Security Operations Center. This role is responsible for taking escalated security alerts from initial triage through investigation, determining scope and impact, documenting findings, and reaching a defensible conclusion.

The Level 3 Analyst will work across multiple client environments and security platforms while providing day-to-day guidance to Level 1 analysts, improving detection quality, and supporting incident response activities.

This is an ideal opportunity for a security professional who enjoys hands-on investigation, threat hunting, detection engineering, and solving complex security incidents rather than simply working an alert queue.

What You'll Do

Security Investigation & Analysis

Own security investigations escalated from Level 1 through resolution.

Determine incident scope, impact, root cause, and final disposition.

Correlate evidence across endpoint, identity, email, and network telemetry.

Perform practical forensic analysis, including:

Log correlation

Endpoint artifact analysis

Email header analysis

Identity and sign-in investigation

Document investigation findings clearly and thoroughly.

Work across multiple security platforms and customer environments.

Incident Response & Escalation

Investigate incidents according to severity-based response requirements and defined MTTA, MTTD, and MTTR objectives.

Coordinate containment activities with the appropriate infrastructure/NOC teams.

Escalate suspected breaches, multi-host or multi-tenant activity, and other high-impact incidents to Level 3 or SOC leadership.

Support major incident response under the direction of senior security personnel.

Contribute findings and recommended follow-up actions to post-incident reviews.

Detection Tuning & Security Operations

Identify recurring false positives and drive improvements to detection quality.

Maintain detection-tuning and false-positive tracking for assigned environments.

Build evidence-based recommendations for detection rule changes.

Evaluate the impact of tuning changes on detection coverage across multiple customer environments.

Validate that detection rules continue to identify the intended threat conditions following changes.

Identify and escalate parser, log-source, and data-ingestion issues that may impact security visibility.

Threat Hunting

Conduct threat hunts based on defined hypotheses across customer environments.

Develop new hunt hypotheses based on emerging threats and observed activity.

Map suspicious activity to MITRE ATT&CK techniques.

Use detection coverage and threat intelligence to guide investigations.

Level 1 Mentorship & Team Support

Provide day-to-day escalation support and technical guidance to Level 1 SOC Analysts.

Validate incident classifications and escalation decisions.

Review Level 1 case documentation for quality and completeness.

Support onboarding and development of junior analysts.

Contribute to SOC playbooks, runbooks, procedures, and knowledge documentation.

Customer Communication & Reporting

Prepare clear incident summaries covering:

What happened

Scope and impact

Actions taken

Recommended remediation

Participate in customer calls when needed.

Maintain accurate and complete case documentation.

Contribute incident trends and security observations to customer reviews and reporting.

Participate in formal shift handoffs to ensure open investigations and follow-up items are not missed.

Required Qualifications

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field or equivalent professional experience.

3–5 years of hands-on SOC or security operations experience.

Demonstrated experience with security alert investigation, incident response, and threat detection.

Experience working with at least one SIEM and one EDR platform.

Ability to independently investigate security incidents without step-by-step direction.

Practical understanding of incident response methodology, including triage, scoping, containment support, evidence handling, and documentation.

Working knowledge of MITRE ATT&CK.

Experience investigating Microsoft 365 and Microsoft Entra ID environments.

Strong written and verbal communication skills.

Ability to manage multiple concurrent investigations in a fast-paced, 24x7 environment.

Strong analytical and problem-solving skills.

Ability to recognize when an incident requires escalation.

Technical Environment

Experience with one or more of the following is highly desirable:

SIEM / SOAR

Google Chronicle

Other enterprise SIEM/SOAR platforms

EDR / MDR

Huntress

CrowdStrike

Microsoft Defender

Other enterprise EDR/XDR platforms

Identity & Cloud

Microsoft 365

Microsoft Entra ID

Azure

Google Cloud Platform

Security Operations

Incident Response

Threat Hunting

Detection Engineering

MITRE ATT&CK

Digital Forensics

Email Security

Endpoint Security

Network Security

Automation

Python

PowerShell

Ticketing / PSA

ConnectWise Manage or similar ticketing/PSA platforms

Certifications

Expected:

CompTIA Security+

CompTIA CySA+

Preferred defensive security certifications include:

Blue Team Level 1 (BTL1)

Blue Team Level 2 (BTL2)

GIAC Certified Incident Handler (GCIH)

GIAC Certified Intrusion Analyst (GCIA)

Hack The Box Certified Defensive Security Analyst (CDSA)

CyberDefenders Certified CyberDefender (CCD)

Additional certifications valued:

CompTIA PenTest+

eJPT

Microsoft SC-200

CrowdStrike certifications

Google Cloud security certifications

What We're Looking For

The successful candidate will be someone who:

Can independently take an escalated alert from investigation through conclusion.

Thinks beyond closing tickets and looks for ways to improve detection quality.

Understands when to resolve an incident and when to escalate.

Can clearly explain technical findings to both technical and non-technical audiences.

Remains composed during active security incidents.

Enjoys mentoring and supporting Level 1 analysts.

Is highly organized and able to prioritize multiple investigations.

Is detail-oriented and documents work as the investigation progresses.

Can adapt quickly as threats, technologies, and customer environments change.

Has strong written and verbal English communication skills.