SOC Analyst

Upperline Health•Nashville, TN

9h•Remote

About The Position

Upperline Health is seeking a SOC Analyst to join its Security Operations team and work directly with the Security Officer to monitor, triage, investigate, and contain security alerts across the Microsoft security stack, Darktrace, and Flare.io. The role protects patient data (PHI/ePHI) at a HIPAA-regulated healthcare organization with clinics and a remote workforce. It addresses after-hours detection coverage and provides a named deputy with privileged access to contain incidents when the Security Officer is unavailable. The schedule is staggered to extend coverage beyond the Security Officer’s hours and includes a rotating on-call schedule, including evenings and weekends. The analyst owns alert intake and response, executes incident-response playbooks, preserves evidence, supports HIPAA breach processes, and contributes to threat hunting and continual improvement of detections and response procedures.

Requirements

2–4+ years of experience in a Security Operations Center or security analyst role at Tier 1/2 level.
Hands-on experience with Microsoft Defender XDR, including Defender for Endpoint, Office 365, Identity, and Cloud Apps, and Microsoft Sentinel, including writing and maintaining KQL queries.
Working knowledge of Microsoft Entra ID and identity containment actions, including disabling accounts, resetting credentials, revoking sessions and tokens, and reviewing MFA methods and device registrations.
Experience with endpoint detection and response tools and device isolation or containment procedures.
Understanding of HIPAA requirements for PHI/ePHI, including breach risk assessment and notification timelines.
Experience responding to phishing, business email compromise, and wire fraud incidents.
Familiarity with incident-response frameworks, playbook-driven response, and evidence preservation and chain-of-custody practices.
Strong written communication skills and ability to produce clear, timestamped incident documentation for technical and non-technical audiences.
Willingness and ability to participate in a rotating on-call schedule, including evenings and weekends.

Nice To Haves

Familiarity with network detection and response tools such as Darktrace.
Familiarity with external threat intelligence or exposure-monitoring tools such as Flare.io.
Relevant security certifications such as Security+, GCIH, GSOC, or SC-200.

Responsibilities

Monitor and triage alerts across Microsoft Defender XDR, Microsoft Entra ID, Darktrace/Identity, Darktrace/Email, and Flare.io using the ULH Alert Triage Playbook.
Classify alerts by severity, meet the specified response targets, and route alerts to the appropriate response playbook.
Own the daily Darktrace and Flare.io intake queues and review alerts in their respective consoles.
Execute incident-response playbooks and run multiple playbooks in parallel when an incident spans multiple types.
Contain identity threats by disabling accounts, resetting credentials, revoking sessions and refresh tokens, removing malicious OAuth grants and inbox or forwarding rules, and reviewing MFA methods and device registrations.
Contain endpoint threats by isolating devices in Defender, collecting investigation packages, and coordinating Intune and Cisco Meraki actions with IT and Network Admins.
Respond to phishing, business email compromise, and wire fraud, coordinating with Finance on time-critical payment recall.
Escalate to the Security Officer when a playbook’s escalation condition is met; help engage Fortified for Critical incidents and begin containment without waiting for the partner.
Preserve evidence before remediation, maintain chain of custody, avoid rebooting suspected compromised devices, and capture short-retention cloud and identity logs before expiration.
Refer suspected PHI/ePHI exposure to the Privacy Officer within 24 hours and support the HIPAA four-factor risk assessment and 60-day notification timeline.
Write clear, timestamped incident notes and summaries for the Security Officer, leadership, Legal/Compliance, and the cyber insurance carrier.
Write and maintain KQL queries in Microsoft Sentinel and Defender Advanced Hunting for investigations and proactive threat hunting.
Verify that Sentinel data connectors are enabled and ingesting, and that mailbox auditing, including MailItemsAccessed, is enabled across the tenant.
Compare playbook alert names with live console exports and tune detections to reduce false positives.
Help maintain playbooks, the IR Contact Directory, and the RACI chart; help plan and conduct tabletop exercises and post-incident reviews.
Track vendor and third-party exposure alerts from Flare.io and support the vendor inventory, including data held, access paths, and BAA status.
Learn the ULH playbooks, complete supervised alert-category walkthroughs, receive privileged access and deputy designation, take ownership of the Darktrace and Flare.io queues, join the on-call rotation, and verify Sentinel connectors and mailbox auditing during the first 90 days.