|
Engagement |
Contractor, Temporary - Ongoing |
|
Schedule |
Monday–Friday, approximately 09:00–14:00 ET or 14:00–19:00 ET. Start and end times can shift by about an hour either way; we'll agree to your exact window before you start. |
|
Weekend |
Sunday 09:00–13:00 ET, shared on a bi-weekly rotation |
|
Hours |
Approximately 20–30 per week, depending on coverage window and your availability. |
|
Rate |
$70–120 per hour depending on experience and shift/window. |
|
Location |
Fully remote, United States. Any time zone. |
|
Term |
Initial 90 days with intent to extend |
|
Start |
September 2026 or sooner. We're moving quickly and can accommodate an early start. |
About the role
We are a managed security services provider seeking an experienced Tier 2 analyst to cover a defined window on a dedicated client account — a public-sector transportation agency with a mature, well-instrumented security stack. You will work alongside our wider SOC team, owning triage, containment, and investigation during your coverage window.
Responsibilities
- Triage and disposition alerts and SOAR cases on the account queue, meeting agreed response targets by priority
- Execute containment and remediation actions in line with established playbooks
- Investigate escalated cases across endpoint, identity, email, and network telemetry, including forensic artifact review where warranted
- Apply threat intelligence and indicators of compromise during triage
- Identify false positives and submit tuning recommendations that reduce alert noise
- Produce case documentation to a standard suitable for client review
- Provide a written handoff at the close of your window
- Contribute to runbook and knowledge base content for the account environment
Platforms
- SIEM, SOAR case queue
- EDR / Identity
- Email Security
- Microsoft Defender for Cloud Apps, Defender for Office 365, and Entra ID
Requirements
- 3–5 years in a SOC or security operations role, with proven ability to work a queue and make disposition decisions independently
- Strong proficiency with EDR/XDR platforms and SIEM triage workflows
- Endpoint and network artifact analysis — registry entries, file system activity, event logs
- Malware triage and behavioral analysis, including sandbox tooling such as VirusTotal or Any.run
- Working knowledge of attacker tradecraft mapped to MITRE ATT&CK
- Sound escalation judgment, with the context to justify decisions
- Clear, structured written documentation — case notes are read by the client
Helpful, not required: direct experience with Google SecOps / Chronicle or CrowdStrike Identity Protection; scripting (PowerShell, Python, Bash, or SQL); detection tuning; prior MSSP or public sector experience.
Requires 3–5 years in SOC or security operations, independent alert disposition, EDR/XDR and SIEM proficiency, endpoint and network artifact analysis, malware triage, MITRE ATT&CK knowledge, and strong documentation.
Key Responsibilities
- triaging alerts
- investigating incidents
- documenting cases
Skills & Tools
SIEM, SOAR, EDR, Microsoft Defender for Cloud Apps, Microsoft Defender for Office 365, Microsoft Entra ID, VirusTotal, Any.Run, MITRE ATT&CK, Google SecOps, Chronicle, CrowdStrike Identity Protection, PowerShell, Python, Bash, SQL
Job Details
- Category: Information Technology
- Seniority: Mid Level
- Commitment: Part Time, Contract, Temporary
- Workplace: Remote — United States
- Salary: USD 145,600 – 249,600 / year
- Languages: English
About STIGroup
A managed security services provider delivering security operations and monitoring. — Industry: Information Technology