SOC Analyst - L3 Expert (Remote)

Primary Objectives

Validate and correlate security alerts to identify true security incidents Investigate attacker activity to determine entry point, scope, impact, and timeline Contain threats swiftly and provide clear remediation guidance Escalate and coordinate with senior SOC / Incident Response teams during major incidents Maintain detailed documentation and highlight visibility or detection gaps Improve monitoring, detection quality, and response effectiveness across the SOC

Key Responsibilities

Monitor and triage security alerts from SIEM, EDR, NDR, and cloud security platforms
Perform deep-dive investigations across endpoint, network, identity, and cloud layers
Differentiate true positives vs false positives with strong analytical judgment
Execute initial incident response actions (containment, isolation, account blocking, etc.) using defined playbooks
Enrich alerts using threat intelligence, MITRE ATT&CK mapping, and contextual analysis
Investigate phishing, malware, ransomware, credential abuse, lateral movement, and persistence techniques
Analyze logs from Windows, Linux, firewalls, network devices, and cloud platforms
Conduct email header analysis and malware/software analysis (static and dynamic)
Perform proactive threat hunting across endpoint, network, and cloud telemetry
Maintain accurate incident timelines, evidence, and internal reports
Collaborate with Detection & Automation teams to reduce alert noise and enhance detection logic
Support 24/7 SOC operations in a rotational shift model, including nights and weekends

Promotional text