SOC Analyst - US

Inforcer•Cerritos, CA

About The Position

We are seeking a SOC Analyst to play a critical role in monitoring, investigating, and responding to security threats across our environment. There are two key parts to the role. Firstly, you will act as the front line of our security operations; reviewing alerts, identifying suspicious activity, and conducting hands‑on investigations using our SIEM, EDR, and threat intelligence tools. This is an operational role with real ownership, ideal for someone who thrives in a fast‑paced environment, enjoys digging into logs, and can bring clarity to complex behaviours across our network, endpoints, and cloud platforms. As part of this, you will take part in regular out‑of‑hours work, which is a natural component of a 24/7 security operation and compensated as overtime. Secondly, you will help strengthen our detection and response capabilities by improving playbooks, enhancing alert quality, and contributing insights that increase our overall readiness. As our environment grows, you’ll play a pivotal role in reducing noise, closing detection gaps, and ensuring incidents are handled quickly, consistently, and with high quality. Your work will directly support our ability to remain secure, resilient, and able to operate without interruption.

Requirements

Hands-on alert triage experience in a SOC, MSP, MSSP or internal security team.
Working KQL, you can query sign-in, audit and hunting data to answer a question unaided.
Strong Microsoft 365 and Entra ID security knowledge: authentication flows, conditional access, OAuth and app consent, mailbox and delegation permissions, and the audit trail behind each.
Practical understanding of MITRE ATT&CK and identity-led attack techniques against Microsoft 365.
Sound judgement on when evidence supports a conclusion, and the confidence to say when it does not.
Clear, concise written English for a technical audience, under time pressure

Responsibilities

Monitor our In-house Custom tooling for real‑time alerts and suspicious activity.
Triage, investigate, and document security incidents following established playbooks.
Perform In-depth log analysis across our customer estate
Escalate incidents as needed and collaborate with internal teams
Support containment and remediation efforts
Contribute to improving detection content by identifying gaps, false positives, and tuning opportunities.
Participate in threat hunting exercises and proactive investigations into anomalous behaviour.
Assist with onboarding and operationalizing new security tools and processes.
Stay current with emerging threats, attack techniques, and security best practices.