Department: Security Operations
Reports To: SOC Technical Lead
Employment Type: Full-Time, Exempt
Work Location: Onsite, Huntsville, Alabama (MAD Security headquarters and 24/7 SOC). Weekday business hours with scheduled on-call. Not remote.
Travel Requirements: Occasional travel for client meetings and industry events
Position SummaryThe SOC Tier 3 Analyst is responsible for detection review, engineering projects, threat hunting, and hands-on incident response under the SOC Technical Lead. You take escalations from Tier 2 and make technical rulings, supporting our clients from Huntsville, Alabama.
You administer and improve the platform the SOC runs on, with Elastic Security on Elastic Cloud Gov at the center, build AI-assisted workflows with human oversight, and understand the Tier 2 and Tier 1 roles your work supports. Tier 3 at MAD Security is where detection quality is decided and where the next SOC Technical Lead comes from.
Primary Responsibilities - Perform final peer review of detection rules before production; reduce false positives and improve detection effectiveness.
- Execute engineering projects, platform improvements, and tool integrations.
- Administer and maintain Elastic and related SOC tooling.
- Execute incident response under the SOC Technical Lead, including scoping, containment, and evidence handling, and make technical rulings on Tier 2 escalations.
- Create, maintain, and approve threat hunt packs and review hunt reports.
- Build and tune AI-assisted SOC workflows for detection, triage, and response.
- Produce reports for technical and executive audiences.
- Understand the Tier 2 and Tier 1 roles your work supports.
What Success Looks Like in the First 12 Months - Rules you review go to production against the published standard and false positives on rules you own are down from baseline.
- Engineering projects delivered end to end, documented, and in use.
- Elastic and related tooling administered to standard with issues resolved in-house first.
- Threat hunt pack exists, is re-runnable by Tier 2, and produces detections and readable reports.
- Incident work shows clean scoping, containment, evidence handling, and root cause with recorded rulings.
- You meet the Tier 3 standard and your work is usable by Tier 2 and Tier 1 without rework.
Required Qualifications Experience - Minimum six years in information security and/or IT, including substantial SOC or NOC experience in an enterprise or MSP/MSSP.
- Expert investigation and incident response skills, including scoping, containment, evidence handling, and root cause analysis.
- Experience authoring, reviewing, tuning, and operationalizing detection content across multiple clients or environments.
Education - Bachelor's degree in Information Technology, Information Security, Computer Science, or equivalent experience.
Technical Qualifications - SIEM platform administration, including ingestion, index lifecycle, integrations, and cluster health.
- Scripting in Python, PowerShell, Bash, or similar.
- Familiarity with AI and automation in a SOC, with sound judgment about human oversight.
Required Certifications - None required. SSCP or CompTIA SecurityX (formerly CASP+) strongly preferred.
Preferred Qualifications - SSCP or CompTIA SecurityX; GCIH, GCIA, GCFA, GCED, or CISSP as alternates.
- Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
- Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012.
- Vulnerability management and purple team or penetration test liaison experience.
Capabilities and Professional Attributes - Judgment to make a technical ruling, record the reasoning, and hold it under pressure.
- Strong problem solving and ability to execute autonomously.
- Clear written and verbal communication with technical and executive audiences.
- Integrity: ethical and respectful to clients and team.
- Grit: self-motivates, self-manages, and meets deadlines when faced with competing priorities.
- Customer-centric: partnership with our clients is a win-win scenario.
- Selfless: when one team member succeeds, we all succeed.
Work Environment - Onsite in Huntsville, Alabama, in an office setting within the 24/7 SOC.
- Weekday business hours, with scheduled on-call.
- Client-facing on technical findings and during incidents.
- Occasional travel for client meetings and industry events.
- Must be a U.S. person; the SOC is staffed by U.S. personnel.
- Physical demands are representative of an office environment.
Other Duties This job description describes the general nature and level of work to be performed. It is not a comprehensive list of duties, responsibilities, and qualifications. MAD Security, LLC reserves the right to amend responsibilities to meet business and organizational needs, with or without notice.
