Title: Sr. Analyst, SOC
End Date:
# of Openings: 1
Position Type: Contract to Hire
Locations: Louisville,
Additional Details:
6 months CTH
100% Remote
Description:
Summary:
We are seeking a Senior Security Analyst to strengthen and mature Security Operations (SOC) detection and response capabilities across enterprise, cloud, and third-party environments. This role is accountable for advanced alert triage, investigation, and incident analysis. The Senior Security Analyst partners closely with the incident response team, IT, and engineering teams to improve signal quality, close detection gaps, and strengthen operational readiness. The ideal candidate is a senior individual contributor with strong investigation skills, excellent judgment under pressure, and the ability to translate attacker behavior and telemetry into actionable response and detection improvements.
Responsibilities:
Performing threat-informed analysis of alerts and events, validating severity, scope, and business impact
Applying threat intelligence and adversary tradecraft to prioritize, contextualize, and enrich investigations
Identifying patterns of attacker behavior and emerging threats; translating findings into detection and response improvements
Conducting advanced alert triage, investigation, and escalation across endpoint, network, identity, SaaS, and cloud telemetry
Investigating identity, access, and configuration-related alerts (e.g., anomalous sign-ins, privilege changes, suspicious OAuth/app consent, policy changes)
Supporting incident investigation and response activities, including containment recommendations and responder handoffs
Collecting, preserving, and analyzing evidence; producing clear documentation suitable for incident reviews and potential legal/compliance needs
Tuning detections and improving signal quality by reducing false positives, improving fidelity, and expanding meaningful coverage
Analyzing detection gaps and control weaknesses surfaced through investigations; partnering with control owners to drive remediation
Validating detection effectiveness through testing, simulation, and structured attack emulation; documenting outcomes and follow-ups
Contributing to post-incident reviews, lessons learned, and playbook/runbook updates
Driving continuous improvement of SOC processes, metrics, and operational readiness; mentoring other analysts as needed
Requirements:
6 years in security operations, incident response, or threat detection, with demonstrated ownership of complex investigations
Strong experience triaging and investigating alerts across SIEM, EDR/XDR, identity platforms, and cloud/SaaS environments
Proficiency with investigation workflows: hypothesis-driven analysis, scoping, timeline creation, and clear escalation/handoff
Hands-on ability to query and analyze telemetry and turn findings into actionable outcomes
Practical knowledge of attacker techniques and common enterprise attack paths (identity compromise, lateral movement, persistence, exfiltration)
Experience applying threat intelligence (IOCs/TTPs) to investigations and to improve detection content
Strong written and verbal communication skills, including producing incident documentation appropriate for technical and leadership audiences
Ability to influence and collaborate across teams (IT, cloud, infrastructure, engineering) and mentor junior members
Required Skills:
Detection and hunting experience
Cloud security operations experience in Google Cloud Platform, including investigation of cloud control plane and SaaS audit logs
Hands-on incident response experience (on-call/rotations), including coordination, containment support, and recovery validation
Scripting/automation skills to enrich investigations and improve SOC efficiency
Preferred Skills:
Leading complex investigations from initial alert through containment recommendations, escalation, and handoff
Correlating endpoint, network, identity, cloud, and SaaS telemetry to validate attacker behavior and determine scope
Enriching cases with threat intelligence and internal context to prioritize response and reduce time-to-decision
Tuning detections and building investigation queries to improve fidelity and reduce repeat noise
Partnering with MSSP and internal incident response team members, IT, and engineering teams to close gaps discovered during investigations
Running targeted threat hunts and validation exercises to confirm detection coverage and document results
Updating playbooks/runbooks and coaching other analysts on investigation quality, documentation, and escalation standards
Benefits:
This role offers hands-on security operations work focused on advanced investigations, incident analysis, and continuous improvement of detection and response across the environment.