SOC Analyst

Horizon3

10d•$123,850 - $161,000•Remote

About The Position

Horizon3.ai is seeking a skilled SOC Analyst to join their growing Security Operations team. This is a mid-level role for an analyst with strong foundational skills in Security Information and Event Management (SIEM) who is ready to take ownership of monitoring, triage, and detection work with minimal day-to-day direction. The analyst will work within one of the SOC shifts and report to the SOC Manager. The role involves monitoring the health and effectiveness of the SIEM platform (Elastic SIEM or equivalent), supporting threat detection, log analytics, and incident response in a high-scale, cloud-native environment. As the analyst grows, they will take on more complex detections and investigations, contribute to process improvements, and help onboard newer analysts. This role is instrumental in helping Horizon3.ai scale and mature its security detection and response capabilities while maintaining a strong security posture across the organization.

Requirements

Must have hands-on SOC or security-analyst experience spanning SIEM monitoring, alert triage, detection tuning, and incident response
Must have working experience with an enterprise SIEM such as Elastic SIEM (preferred), Splunk, Microsoft Sentinel, QRadar, or similar
Must have a solid grasp of log analysis, security telemetry, and event correlation
Must have proficiency with detection-rule authoring and query languages (KQL, Lucene, SPL) and scripting in Python, Bash, or PowerShell
Must have familiarity with at least one major cloud (AWS, GCP, or Azure) and its security tooling
Must have working knowledge of MITRE ATT&CK, NIST, and CIS
Must have practical familiarity with using LLMs / AI assistants at work, including effective prompting, grounding responses in trusted data, and recognizing model limitations and when to verify output
Must have strong analytical and problem-solving skills, with the ability to prioritize and manage your own work with minimal direction
Must have clear written and verbal communication and the ability to document processes and findings
Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent hands-on security operations experience
3–6 years in a SOC or security analyst role
Demonstrated hands-on experience operating an enterprise SIEM (Elastic SIEM preferred) in a cloud environment

Nice To Haves

Certifications such as Security+, CySA+, GCIA, GCIH, or Elastic Certified Analyst
Hands-on experience with endpoint detection and response (EDR) or XDR platforms
Judgment about which model fits which task, e.g., fast, lower-cost models for high-volume triage vs. stronger reasoning models for complex investigations, and how to prompt each for reliable results
Experience building agentic workflows that chain models, tools, and data sources (e.g., automated enrichment, triage, or investigation summarization) on an enterprise AI platform
Experience mentoring or onboarding junior analysts, or leading small process improvements end-to-end
Experience in a high-growth SaaS or cybersecurity company

Responsibilities

Monitor, detect, and respond to security events across enterprise environments using the SIEM
Support log ingestion, parsing, and normalization, and monitor ingestion health across critical sources (AWS, Okta, endpoints, firewalls, SaaS), partnering with system owners to close telemetry gaps
Build and maintain dashboards, visualizations, and KPIs that demonstrate SIEM effectiveness and security visibility
Triage, investigate, and validate alerts, escalating confirmed or ambiguous incidents to a Senior Analyst or the SOC Manager with clear context
Tune and test detection rules (behavioral, heuristic, signature-based) to reduce false positives and improve fidelity
Use frameworks such as MITRE ATT&CK to contextualize detections and identify coverage gaps
Analyze logs across cloud, endpoint, network, and application sources to surface anomalies and potential threats
Perform structured investigations and root cause analysis, providing attack-chain mapping and remediation guidance for escalated alerts
Follow and help refine response playbooks for common incident types (phishing, suspicious logins, endpoint malware, privilege escalation, cloud misconfiguration), documenting lessons learned to strengthen detection logic
Contribute to SOAR automation (e.g., Tines or similar) to reduce manual toil and improve mean time to detect (MTTD) and respond (MTTR)
Use LLM/AI-assisted tooling to speed up triage, log summarization, and investigation enrichment, and contribute to SOC AI agent and automation workflows, verifying model output before acting on it
Participate in proactive threat hunting and contribute to weekly and monthly reporting on threat trends, false-positive reduction, and detection efficacy
Communicate clearly with shift peers and stakeholders, and, as you progress toward P3, help train and onboard more junior analysts
Demonstrate a commitment to integrity, process improvement, and customer satisfaction