Note: The job is a remote job and is open to candidates in USA. Horizon3.ai is a remote cybersecurity company focused on helping organizations proactively identify, remediate, and verify exploitable attack vectors. The SOC Analyst will monitor and improve SIEM operations, investigate security alerts, support threat detection and incident response, and contribute to automation, threat hunting, and analyst development.
Responsibilities
- Monitor, detect, and respond to security events across enterprise environments using the SIEM
- Support log ingestion, parsing, and normalization, and monitor ingestion health across critical sources (AWS, Okta, endpoints, firewalls, SaaS), partnering with system owners to close telemetry gaps
- Build and maintain dashboards, visualizations, and KPIs that demonstrate SIEM effectiveness and security visibility
- Triage, investigate, and validate alerts, escalating confirmed or ambiguous incidents to a Senior Analyst or the SOC Manager with clear context
- Tune and test detection rules (behavioral, heuristic, signature-based) to reduce false positives and improve fidelity
- Use frameworks such as MITRE ATT&CK to contextualize detections and identify coverage gaps
- Analyze logs across cloud, endpoint, network, and application sources to surface anomalies and potential threats
- Perform structured investigations and root cause analysis, providing attack-chain mapping and remediation guidance for escalated alerts
- Follow and help refine response playbooks for common incident types (phishing, suspicious logins, endpoint malware, privilege escalation, cloud misconfiguration), documenting lessons learned to strengthen detection logic
- Contribute to SOAR automation (e.g., Tines or similar) to reduce manual toil and improve mean time to detect (MTTD) and respond (MTTR)
- Use LLM/AI-assisted tooling to speed up triage, log summarization, and investigation enrichment, and contribute to SOC AI agent and automation workflows, verifying model output before acting on it
- Participate in proactive threat hunting and contribute to weekly and monthly reporting on threat trends, false-positive reduction, and detection efficacy
- Communicate clearly with shift peers and stakeholders, and, as you progress toward P3, help train and onboard more junior analysts
- Demonstrate a commitment to integrity, process improvement, and customer satisfaction
Skills
- • Must have hands-on SOC or security-analyst experience spanning SIEM monitoring, alert triage, detection tuning, and incident response
- • Must have working experience with an enterprise SIEM such as Elastic SIEM (preferred), Splunk, Microsoft Sentinel, QRadar, or similar
- • Must have a solid grasp of log analysis, security telemetry, and event correlation
- • Must have proficiency with detection-rule authoring and query languages (KQL, Lucene, SPL) and scripting in Python, Bash, or PowerShell
- • Must have familiarity with at least one major cloud (AWS, GCP, or Azure) and its security tooling
- • Must have working knowledge of MITRE ATT&CK, NIST, and CIS
- • Must have practical familiarity with using LLMs / AI assistants at work, including effective prompting, grounding responses in trusted data, and recognizing model limitations and when to verify output
- • Must have strong analytical and problem-solving skills, with the ability to prioritize and manage your own work with minimal direction
- • Must have clear written and verbal communication and the ability to document processes and findings
- • Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent hands-on security operations experience
- • 3–6 years in a SOC or security analyst role
- • Demonstrated hands-on experience operating an enterprise SIEM (Elastic SIEM preferred) in a cloud environment
- • SIEM platforms: Elastic SIEM (preferred), Splunk, Microsoft Sentinel, or QRadar
- • Query and detection languages: KQL, Lucene, or SPL
- • Scripting: Python, Bash, or PowerShell
- • Cloud platforms: AWS, GCP, and/or Azure
- • Security frameworks: MITRE ATT&CK, NIST, CIS
- • SOAR / automation platforms (e.g., Tines or similar)
- • Enterprise LLM / AI platforms (e.g., Claude, Gemini, AWS Bedrock, or similar) and prompt/agent tooling
- Only US persons can interview for this role due to security clearance requirements by our customer(s) and/or vendor(s). Employee must be eligible for and successfully secure a US Federal Security Clearance as a condition of employment
- We are a fully remote company, and this job may require up to 5% of travel to be successful
- • Certifications such as Security+, CySA+, GCIA, GCIH, or Elastic Certified Analyst
- • Hands-on experience with endpoint detection and response (EDR) or XDR platforms
- • Judgment about which model fits which task, e.g., fast, lower-cost models for high-volume triage vs. stronger reasoning models for complex investigations, and how to prompt each for reliable results
- • Experience building agentic workflows that chain models, tools, and data sources (e.g., automated enrichment, triage, or investigation summarization) on an enterprise AI platform
- • Experience mentoring or onboarding junior analysts, or leading small process improvements end-to-end
- • Experience in a high-growth SaaS or cybersecurity company
Benefits
- All full-time roles are eligible for an equity package in the form of stock options.
- Career development opportunities.
- A collaborative environment that encourages creativity and out-of-the-box thinking.
- Fully remote work arrangement.
- Health, vision & dental insurance for you and your family.
- A flexible vacation policy.
- Generous parental leave.
Company Overview