SOC Analyst II

Sentinel Blue

20d • $70,000 - $80,000 • Remote

About The Position

Sentinel Blue is seeking a Security Operations Center (SOC) Analyst II to join its Overwatch Team. The analyst leads analysis, containment, and remediation of complex threats beyond initial triage, managing concurrent investigations across a multi-tenant client base and investigating incidents from detection through resolution. The role also drives improvements to workflows, playbooks, and documentation and helps advance capabilities in digital forensics and incident response (DFIR), threat hunting, vulnerability management, and threat intelligence. Collaboration and mentoring junior staff are important aspects of the position.

This is a fully remote, full-time position. Employees must be U.S. citizens and eligible for a Secret clearance. The analyst participates in an on-call rotation for critical security incidents outside standard business hours. Sentinel Blue describes its environment as fast-paced, dynamic, focused on learning and innovation, and offering exposure to emerging technologies and opportunities to build skills. Success in the role can lead to a team leadership position.

Requirements

• U.S. citizenship and eligibility for a Secret clearance.
• A minimum of 2–5 years of experience in a Security Operations Center and/or a combination of experience in cyber-adjacent or IT administration roles.
• Experience performing incident response deep dives and correlating events across logs, host artifacts, and network artifacts for root cause analysis and response across the incident-response lifecycle.
• Intermediate to advanced understanding of Windows internals, including Event Tracing for Windows, Win32 API, the Registry, memory, and process operations.
• Ability to map adversary tactics, techniques, and procedures to the MITRE ATT&CK framework.
• Ability to correlate incidents with threat feeds using Indicators of Compromise (IoCs), threat actor attribution, and vulnerability exploitation patterns.
• Intermediate to advanced understanding of common network protocols, including TCP/IP, DNS, HTTP, and SSL/TLS.
• Intermediate to advanced ability to write and interpret Python or PowerShell scripts to parse logs or automate repetitive tasks; other scripting languages are beneficial.
• Ability to safely manage Windows devices from the command line using PowerShell or Batch.
• Basic malware analysis skills, including detecting and reverse engineering malicious scripts or other high-level languages; understanding of code injection and other Windows attack and evasion techniques.
• Prior experience with SIEM platforms such as Microsoft Sentinel, ELK/Elastic Stack, or Splunk; hands-on experience with tools such as Sysinternals Suite, Volatility, SIFT Workstation, CyberChef, Forensic Browser for SQLite, Velociraptor, Explorer Suite, Wireshark, and malware analysis sandboxes; equivalent tools are acceptable.
• Familiarity with adversarial tradecraft, including malware development, social engineering, phishing, exploitation, persistence, evasion, credential theft, command and control, exfiltration, and lateral movement.

Nice To Haves

• Intermediate to advanced certifications such as GCIH, GCIA, GCFA, OSCP, BTL2, or equivalent.
• Previous team lead or supervisory experience, including driving operational goals, managing complex escalations, and mentoring junior staff.
• Experience with Azure, Microsoft Sentinel/Defender XDR, Entra ID, and Kusto Query Language (KQL).
• Active participation in Capture-the-Flag (CTF) events and homelabbing.
• Understanding of low-level mechanics such as x64 assembly, Windows data structures, and research into undocumented parts of the Windows OS.
• Familiarity with low-level reverse engineering, debugging, and related tools such as Ghidra, x64dbg, and IDA.

Responsibilities

• Serve as the primary escalation point for Tier I analysts and take ownership of critical or high-severity alerts and escalated security incidents.
• Analyze endpoint, network traffic, and other log data to validate security incidents and perform root cause analysis.
• Lead containment, eradication, and recovery during active security incidents, following and documenting Standard Operating Procedures (SOPs) and Incident Response (IR) Plans.
• Reconstruct attack chains and use MITRE ATT&CK and the Cyber Kill Chain to map adversary tactics, techniques, and procedures (TTPs).
• Conduct intelligence- or hypothesis-driven threat hunts across environments to detect advanced threats that evade security tools and controls.
• Write executive reports with clear narrative structure, detailed analysis, and actionable recommendations.
• Manage the vulnerability management lifecycle by analyzing scan results, prioritizing critical vulnerabilities based on risk and exploitability, and coordinating remediation with IT and Engineering.
• Develop and maintain IR playbooks and SOPs for consistent and efficient event handling.
• Provide technical guidance, training, and feedback to Tier 1 analysts to improve their triage capabilities and knowledge.
• Participate in an on-call rotation to cover critical security incidents outside standard business hours.
• Collaborate with colleagues and mentor junior staff.
• Drive improvements to workflows, playbooks, and documentation and help advance DFIR, threat hunting, vulnerability management, and threat intelligence capabilities.

Benefits

• Fully paid individual healthcare, vision, and dental insurance for the employee.
• Paid certification and training opportunities.
• Three weeks of paid vacation and 11 paid holidays.
• A supportive environment focused on maintaining a healthy work-life balance.
• 401(k) retirement benefit with company match.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed