Location: Remote (U.S. Nationwide) | South Carolina candidates preferred Duration: 12-Month Contract (Extension Possible) Work Hours: Eastern Time (ET) Interview: Virtual; potential second-round onsite interview

Job Description

We are seeking an experienced SOC Analyst – Incident Response to support security operations, threat detection, incident investigation, and response activities. The ideal candidate will have hands-on experience in Security Operations Center (SOC) environments, security monitoring, incident response, MITRE ATT&CK, and security dashboard creation and reporting.

Key Responsibilities

Monitor and correlate security events across SIEM, EDR/XDR, IDS/IPS, and threat intelligence platforms to identify threats and potential security incidents. Investigate suspicious activities, phishing attempts, malware infections, and security alerts; determine root cause, scope, and impact. Perform incident analysis and escalate critical incidents to Tier 3 teams with detailed findings and supporting evidence. Create incident reports, investigation timelines, dashboards, and post-incident summaries. Apply the MITRE ATT&CK framework to analyze adversary tactics, techniques, and procedures (TTPs). Recommend improvements to SOC playbooks, detection rules, alert thresholds, and correlation logic to reduce false positives. Support proactive threat hunting and integrate threat intelligence into security monitoring workflows. Collaborate with security engineering, SOC teams, and agency stakeholders to improve detection and response capabilities. Document operational procedures, runbooks, troubleshooting steps, and remediation recommendations. Communicate security findings and provide technical guidance to stakeholders.

Required Qualifications

At least 2 years of experience in security monitoring and incident response. At least 2 years of experience working with the MITRE ATT&CK framework. At least 2 years of experience creating dashboards and security reports. Experience supporting large-scale Security Operations Center (SOC) operations. Associate degree in Information Technology, Information Security, or a related field; alternatively, four years of relevant work experience may substitute for the degree.

Preferred Qualifications

Hands-on experience with Palo Alto Cortex XSIAM/XDR. Knowledge of Linux, network administration, and network design. Experience administering firewalls, VPN technologies, Active Directory, and IDS/IPS solutions. Strong analytical, troubleshooting, documentation, and communication skills. Candidates located in Columbia, SC, or surrounding areas are strongly preferred. Work Arrangement This is a remote contract opportunity open to candidates nationwide who can work Eastern Time hours. Candidates must be willing to travel onsite when project needs require it. All travel-related expenses for onsite work are the responsibility of the candidate. Preference will be given to candidates who can support onsite project needs, particularly those local to South Carolina. Interested candidates: Please share your updated resume along with your relevant SOC experience, MITRE ATT&CK expertise, and experience with SIEM/EDR/XDR platforms.