Security Operations Center (SOC) Tier-3 Analyst

MAD Security•Huntsville, AL

4d•Onsite

About The Position

The SOC Tier 3 Analyst is responsible for detection review, engineering projects, threat hunting, and hands-on incident response under the SOC Technical Lead. The analyst takes escalations from Tier 2 and makes technical rulings, supporting clients from MAD Security’s Huntsville, Alabama headquarters. The role administers and improves the SOC platform, centered on Elastic Security on Elastic Cloud Gov, builds AI-assisted workflows with human oversight, and understands the Tier 2 and Tier 1 roles supported by the work. The position is onsite in an office setting within MAD Security’s 24/7 SOC, during weekday business hours with scheduled on-call duties. It is client-facing for technical findings and during incidents, and involves occasional travel for client meetings and industry events. The SOC is staffed by U.S. personnel, and the analyst must be a U.S. person. MAD Security describes Tier 3 as the point where detection quality is decided and a potential path to becoming the next SOC Technical Lead. Success includes reviewing rules to the published standard, reducing false positives, delivering documented engineering projects, administering tools to standard, creating rerunnable threat hunt packs, handling incidents with sound scoping and evidence practices, and producing work Tier 1 and Tier 2 can use without rework.

Requirements

At least six years of experience in information security and/or IT, including substantial SOC or NOC experience in an enterprise or MSP/MSSP.
Expert investigation and incident response skills, including scoping, containment, evidence handling, and root cause analysis.
Experience authoring, reviewing, tuning, and operationalizing detection content across multiple clients or environments.
Bachelor’s degree in Information Technology, Information Security, Computer Science, or equivalent experience.
SIEM platform administration experience, including ingestion, index lifecycle, integrations, and cluster health.
Scripting experience in Python, PowerShell, Bash, or a similar language.
Familiarity with AI and automation in a SOC, with sound judgment about human oversight.
Must be a U.S. person.

Nice To Haves

SSCP or CompTIA SecurityX (formerly CASP+) certification is strongly preferred; GCIH, GCIA, GCFA, GCED, or CISSP are listed as alternatives.
Experience with Elastic, Fortinet, Avanan, OpenText NDR, and Microsoft Sentinel.
Familiarity with NIST SP 800-171, CMMC, and DFARS 252.204-7012.
Vulnerability management experience.
Purple team or penetration test liaison experience.
Strong technical and executive communication skills, sound judgment, problem-solving ability, autonomy, integrity, grit, customer focus, and a collaborative approach.

Responsibilities

Perform final peer review of detection rules before production, reducing false positives and improving detection effectiveness.
Execute engineering projects, platform improvements, and tool integrations.
Administer and maintain Elastic and related SOC tooling.
Execute incident response under the SOC Technical Lead, including scoping, containment, and evidence handling.
Make technical rulings on Tier 2 escalations.
Create, maintain, and approve threat hunt packs and review hunt reports.
Build and tune AI-assisted SOC workflows for detection, triage, and response.
Produce reports for technical and executive audiences.
Understand the Tier 2 and Tier 1 roles supported by the work.
Participate in client-facing technical findings and incident work.
Travel occasionally for client meetings and industry events.