SOC Analyst

Duration: 12 Months Scope: This role will focus on supporting security monitoring, threat detection, security incident response and security investigations. Daily Duties / Responsibilities: - Continuously review and correlate security event data across SIEM, EDR, IDS/IPS, and threat intelligence sources to identify complex attack patterns, emerging threats, and security incidents. - Perform deep-dive analysis of suspicious activity, validate incidents, determine root cause and impact, and escalate critical incidents with detailed context to Tier 3 as required. - Create detailed incident reports, timelines, and post-incident summaries; contribute to lessons-learned documentation and recommendations for remediation and preventative measures. - Investigate user-reported phishing, malware infections, and potential policy violations; advise users and internal/external teams on containment and recovery actions. - Recommend updates to SOC playbooks and workflows based on real-world investigations; fine-tune detection rules, alert thresholds, and correlation logic to reduce false positives and improve threat coverage. - Collaborate with engineering teams to ensure monitoring tools are properly configured and tuned. - Integrate new threat intelligence feeds into workflows and proactively hunt for threats using up-to-date tactics, techniques, and procedures (TTPs). - Serve as a customer-facing SME, “selling” the value of Client services by demonstrating capabilities and resolving issues. - Document processes, runbooks, and troubleshooting steps related to SOC operations. - Coordinate with engineering, SOC, and agency staff as needed to meet goals. - Other duties as needed. Required Skills (rank in order of Importance): - 2+ Years of Experience with Security Monitoring and Incident Response. - 2+ Years of Experience with MITRE Telecommunication&CK