4+ years of professional cybersecurity experience, ideally in SOC operations or incident response.
Proven track record in investigating security alerts and responding to incidents.
Strong grasp of enterprise security monitoring tools like SIEM, EDR, NDR, and XDR.
Familiarity with the MITRE ATT&CK framework and cyber kill chain methodologies.
Experience with security events across Windows, Linux, Active Directory, and cloud environments.
Knowledge of network security concepts including firewalls and traffic analysis.
Excellent analytical skills and ability to work independently on complex issues.
Responsibilities
Investigate cybersecurity alerts to assess threats and coordinate responses.
Perform detailed incident investigations and analyze attacker behavior.
Conduct proactive threat hunting to identify suspicious activities.
Apply MITRE ATT&CK framework to analyze adversary tactics and techniques.
Leverage various technologies to enhance threat detection and investigation.
Collaborate with detection engineering to improve monitoring and reduce false positives.
Support digital forensic investigations and contribute findings during incidents.
Benefits
Opportunities for continuous learning and professional development.
Collaborative work environment with security automation specialists.
Engagement in impactful security initiatives to enhance operational resilience.
Access to advanced cybersecurity technologies and methodologies.
Full Job Description
Job Description How You Will Make An Impact
Investigate cybersecurity alerts and suspicious activity to determine potential threats, assess severity, identify root causes, and coordinate appropriate responses.
Perform detailed incident investigations, including analyzing attacker behavior, identifying compromised assets, and reconstructing security events.
Conduct proactive threat hunting across enterprise systems to identify suspicious behavior that may have bypassed existing security controls.
Apply the MITRE ATT&CK framework and cyber kill chain concepts to analyze adversary tactics, techniques, and procedures (TTPs).
Leverage SIEM, EDR, NDR, XDR, and behavioral analytics technologies to investigate threats and improve detection effectiveness.
Partner with detection engineering teams to identify monitoring gaps, reduce false positives, and enhance security alerting capabilities.
Collaborate with security automation specialists to streamline repetitive investigation and response activities.
Support digital forensic investigations and contribute technical findings during cybersecurity incidents.
Develop, maintain, and improve SOC investigation procedures, incident response playbooks, and operational documentation.
Evaluate emerging attack techniques and assess the organization's ability to detect and respond to them.
Analyze security activity across Windows, Linux, Active Directory, cloud environments, and enterprise networks.
Contribute to security initiatives that improve operational resilience, response efficiency, and overall cybersecurity maturity.
Requirements Are You An Experienced SOC And Incident Response Professional Ready To Make An Impact?
4+ years of professional cybersecurity experience, preferably involving hands-on SOC operations, incident response, threat hunting, or digital forensics. Candidates with 5-7 years of relevant experience are particularly aligned with the role.
Demonstrated experience investigating security alerts, analyzing suspicious activity, and responding to cybersecurity incidents.
Strong understanding of enterprise security monitoring technologies, including SIEM, EDR, NDR, XDR, and UEBA.
Working knowledge of the MITRE ATT&CK framework, cyber kill chain methodology, and common attacker techniques.
Experience investigating security events involving Windows, Linux, Active Directory, and cloud technologies.
Knowledge of network security concepts, including firewalls, proxy servers, email security, and network traffic analysis.
Ability to distinguish genuine security threats from false positives and recommend improvements to detection logic.
Familiarity with threat hunting methodologies, digital forensics, and incident response procedures.
Strong analytical and troubleshooting skills with the ability to investigate complex technical issues independently.
Excellent written and verbal communication skills, particularly when documenting investigations and communicating technical findings.
Ability to prioritize competing incidents and responsibilities in a fast-paced security operations environment.
Self-motivated, detail-oriented, and committed to continuous learning and cybersecurity improvement.
Professional certifications such as GCIH, GNFA, GCFA, CEH, OSCP, CISSP, or comparable credentials are advantageous but not required.
