Security Operations Center (SOC) Analyst

Job Description:

• Monitor client environments continuously for cybersecurity threats using SIEM, endpoint detection and response, identity protection, and email security platforms
• Own the live alert queue during each shift; triage detections, determine scope and severity, and execute or authorize appropriate responses
• Conduct structured shift handoffs and ensure every detection, investigation, and client commitment has a clear owner
• Investigate account compromise, business email compromise, social engineering, malware, and ransomware incidents
• Analyze servers, workstations, identities, and other potentially compromised assets
• Contain and remediate confirmed threats using automation workflows, scripts, policies, playbooks, and platform controls
• Escalate incidents according to the incident response plan when they exceed the analyst’s authority or expertise
• Provide timely, professional incident communications to clients and internal stakeholders
• Perform scheduled vulnerability scanning across client environments
• Support CMMC and NIST SP 800-171 compliance objectives by producing required monitoring evidence, logs, and reports
• Review overnight Tines automation logs, validate automated actions, and remediate or escalate exceptions
• Respond to overnight escalations while on call and document all actions
• Identify repetitive manual work and false positives for automation or detection tuning
• Test and provide structured feedback on new detections and automation workflows
• Track and document all work in the ticketing system
• Meet KPIs, support peers across both shifts, and escalate assignments when necessary

Requirements:

• Two or more years of experience in security operations, incident response, or systems administration with a demonstrable security focus
• Demonstrated experience investigating and responding to identity, endpoint, and email-based threats in Microsoft 365 environments
• Working knowledge of SIEM operations, log analysis, and alert triage methodology
• Understanding of common attack techniques and the MITRE ATT&CK framework
• Familiarity with endpoint detection and response, identity protection, and email security controls and remediation actions
• Ability to perform disciplined, well-documented investigations
• Solid understanding of Microsoft 365 and Entra ID administration, including conditional access, authentication methods, and audit logging
• Working knowledge of Windows server and workstation operating systems, Active Directory, TCP/IP, DNS, firewalls, and VPN
• Familiarity with vulnerability scanning platforms and remediation workflows
• Comfort validating and troubleshooting automated playbooks, including Tines or comparable SOAR tooling
• Basic scripting or query proficiency in PowerShell, KQL, or similar
• Disciplined ticket hygiene and documentation habits
• Ability to write clear, professional client-facing communications
• Reliability and self-management appropriate to a remote, shift-based role
• CompTIA Security+ certification, or attainment within the first six months
• CompTIA Network+ certification, or attainment within the first six months
• Must be willing to work EST hours
• Managed service provider experience is strongly preferred
• Experience supporting CMMC, NIST SP 800-171, or similar regulatory frameworks is desirable
• Prior detection engineering or automation playbook development experience is desirable
• Experience in a 24x7 or shift-based security operations environment is desirable

Benefits:

• Medical Insurance — OSIbeyond pays 75% of the premium for the Employee's base medical plan
• Vision and Dental Insurance — OSIbeyond pays 75% of the premium for the Employee's plans
• Life Insurance — OSIbeyond pays 100% of the premium for the Employee's plans
• Short Term Disability Insurance — OSIbeyond pays 100% of the premium for the Employee's plans
• 401K with employer matching up to 4%
• 9 paid holidays
• Accrual-based PTO increasing with tenure; new hires start with 2 weeks