Job Summary:
The Senior SOC Analyst (Level 3) will serve as the senior technical authority within the Security Operations Center, leading investigations and responses to the organization's most complex and critical security incidents. The role involves acting as a technical lead or incident commander during major security events, performing advanced forensics and malware analysis, and leading proactive threat hunting to identify threats that evade existing controls. The analyst will drive detection engineering and automation strategies, mentor Level 1 and Level 2 analysts, and collaborate with Cyber Defense Operations leadership and cross-functional teams, including Legal, Privacy, and IT, to reduce security risks and enhance SOC capabilities. This is an onsite position based in Irving, TX.
Key Responsibilities:
• Lead complex and critical incident response activities, acting as technical lead or incident commander for high-impact incidents such as ransomware, business email compromise, data exfiltration, and insider threats.
• Direct containment, eradication, and recovery activities across multiple teams, making real-time technical decisions within delegated authority.
• Perform advanced forensic analysis of endpoints, memory, and cloud environments to establish root cause, attacker dwell time, and the full scope of compromise.
• Provide clear incident briefings and status updates to management, IT security leadership, and stakeholders such as Legal, Privacy, and Communications.
• Lead post-incident reviews and drive remediation of root causes and security control gaps to completion.
• Design and lead hypothesis-driven threat hunts based on threat intelligence, MITRE ATT&CK coverage gaps, and environmental risk.
• Perform static and dynamic malware analysis to extract indicators of compromise (IOCs), identify malicious behaviors, and develop detection opportunities.
• Analyze adversary tactics, techniques, and procedures (TTPs) targeting retail, payment, and franchise environments and translate findings into defensive actions.
• Partner with the Threat Intelligence team to assess emerging threats and determine organizational exposure.
• Own the SOC detection lifecycle, including detection standards, peer reviews, and approval of new and tuned rules developed by Level 2 analysts.
• Measure and improve detection coverage against MITRE ATT&CK, prioritizing gaps based on threat relevance and business risk.
• Design advanced Cortex XSOAR workflows for enrichment, containment, and case management.
• Validate detection and response capabilities through purple team exercises, attack simulations, and adversary emulation.
• Partner with security and infrastructure engineering teams to onboard new log sources and improve telemetry quality.
• Serve as the senior escalation point for Level 1 and Level 2 analysts and as the on-call technical lead for critical incidents.
• Mentor and develop analysts through case reviews, training sessions, and structured skill development plans.
• Author and maintain SOC incident response playbooks, standard operating procedures (SOPs), and escalation criteria.
• Advise SOC management on tooling, process improvements, staffing needs, and the SOC maturity roadmap.
• Design and facilitate tabletop exercises and readiness drills for the SOC and cross-functional teams.
• Support audit and compliance requests, including PCI DSS requirements related to security monitoring and incident response.
• Develop and execute queries and scripts using tools such as SPL, XQL, Python, PowerShell, and VS Code for log analysis and automated simulation of security scenarios to validate detection rules.
• Monitor deployed detections for failures, query errors, and logic gaps, and investigate detections that stop triggering.
• Conduct attack simulations and evaluate detection coverage, alert accuracy, and effectiveness to drive continuous improvements.
Required Qualifications:
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent professional experience.
• 6+ years of experience in cybersecurity, including at least 4 years in SOC, incident response, or threat hunting roles.
• Demonstrated experience leading responses to complex, high-severity incidents from detection through recovery.
• Advanced proficiency with SIEM and EDR platforms, including complex query development such as Splunk SPL and detection engineering.
• Deep knowledge of Windows, Linux, Active Directory, and cloud attack techniques, including persistence, privilege escalation, and lateral movement.
• Hands-on experience with digital forensics, including memory, disk, and log analysis, as well as malware analysis.
• Proficiency in Python or PowerShell for automation, data analysis, and tooling.
• Experience with scripting and automation tools such as PowerShell, Python, or XQL for cyber defense operations and investigations.
• Ability to develop and execute queries such as SPL and XQL, and scripts using Python or PowerShell for log analysis and automated security scenario simulations.
• Experience monitoring deployed detections for failures, query errors, and logic gaps, and investigating detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness.
• Proven ability to mentor analysts and communicate technical findings to executives and non-technical stakeholders.
• Ability to make sound decisions under pressure and act as the technical lead during critical incidents.
• Willingness to participate in an on-call rotation as the senior escalation resource.
Preferred Qualifications:
• Industry certifications such as CISSP, GIAC GCFA, GCIH, GREM, GCTI, or OSCP.
• Experience developing Cortex XSOAR content and implementing risk-based alerting in Splunk ES.
• Experience responding to incidents in cloud environments such as AWS, Azure, or Google Cloud, and Microsoft 365.
• Experience planning or conducting purple team and adversary emulation exercises.
• Experience in retail, payments, or PCI DSS-regulated environments, including familiarity with breach notification requirements.
• Prior experience as an incident commander, SOC shift lead, or team lead.
• Experience with SIEM tools such as Splunk ES, including advanced SPL, data models, and risk-based alerting.
• Experience with EDR platforms such as Palo Alto Cortex, including advanced hunting queries and live response.
• Experience with SOAR and ticketing platforms such as Palo Alto Cortex XSOAR, ServiceNow, and Jira.
• Experience with forensic and malware analysis tools such as Volatility, KAPE, Velociraptor, malware sandboxes, and Ghidra.
• Knowledge of network security technologies, including firewalls, IDS/IPS, proxy and DNS logs, and full packet capture.
• Experience analyzing cloud and identity audit logs across AWS, Azure, Google Cloud, Active Directory, and Microsoft Entra ID.
• Familiarity with threat intelligence platforms such as VirusTotal, Google Threat Intelligence, and Recorded Future.
• Experience with adversary emulation tools such as Atomic Red Team and MITRE Caldera.
• Knowledge of security frameworks and methodologies, including MITRE ATT&CK, NIST Incident Response Lifecycle (SP 800-61), Diamond Model, and Pyramid of Pain.
