SOC Analyst Tier 3

JFL Consulting • Springfield, VA

1d • Onsite

About The Position

We're looking for a SOC Analyst Tier 3 and Incident Responder, a senior analyst role in the SOC. This role leads the response to confirmed security incidents, conducts threat hunting operations, and provides deep technical analysis capability in the operations center. Tier 3/IR analysts are activated for severe incidents and are the primary interface to the Tier 4 SME and external response resources when needed.

Requirements

• 5+ years of SOC, threat hunting or incident response type experience
• Bachelor's degree in Cyber Security, Information Technology, Computer Science, Information Security, or related field. In lieu of degree, four additional years of experience in a NOC, SOC, IT security, or network engineering role
• Two of the following certifications, equivalent or better: Sec+, CYSA+, GCIH, SecX, CEH, GCIA, GSOC, CISSP
• Demonstrated hands-on incident response experience including containment, eradication, and recovery
• Proficiency with SIEM platforms and log analysis
• Proficiency with SIEM query languages — SPL, KQL, or equivalent
• Proficiency with PCAP analysis tools (Wireshark, NetworkMiner, or equivalent)
• Experience with EDR, endpoint forensics, memory analysis, and network forensics tools
• Deep understanding of attacker TTPs, kill chain methodology, and MITRE ATT&CK

Nice To Haves

• GCFA or GCFE certification or other forensic certifications
• Active Secret clearance preferred but not required
• Experience with threat hunting frameworks and platforms
• Reverse engineering experience (IDA Pro, Ghidra)
• Prior experience on a DFIR team or incident response retainer
• Experience with malware analysis (static and dynamic)

Responsibilities

• Provide Tier 3 escalation and resolution for the most complex incidents and outages escalating to the Tier 4 SME as needed with appropriate documentation
• Lead the response to Priority 1 and complex Priority 2 security incidents from detection through remediation
• Conduct proactive threat hunting operations to identify threats that have bypassed automated detection
• Perform advanced PCAP analysis, log analysis, memory forensics, and malware triage
• Contain and eradicate threats while coordinating with engineers for isolation and remediation
• Produce formal incident response reports for Priority 1 and Priority 2 incidents
• Develop and maintain threat hunting TTPs and playbooks
• Build new detection use cases from threat hunting findings and submit to SIEM engineer
• Serve as on-call incident responder
• Brief senior leadership during active high priority incidents
• Mentor Tier 1 and 2 analysts in investigation techniques and escalation decision-making
• Manage and own the SOC Event log for all events during the shifts
• Maintain situational awareness of the threat landscape and active campaigns
• Participate briefings and training sessions

Benefits

• 100% employer-paid medical, dental, and vision premiums for employees and dependents
• Flexible Spending Accounts (healthcare, dependent care, and commuter)
• Life insurance, short-term disability and long-term disability
• 401(k) with immediate vesting of company contribution
• Generous PTO policy (15 vacation, 5 sick, 2 personal days, 11 holidays)
• Certification reimbursement
• Dedicated professional development funding
• Company-provided access to online learning platforms

What This Job Offers

• Job Type: Full-time
• Career Level: Senior