SOC Analyst

Consensys • New York, NY

7d • Remote

About The Position

Following Consensys's strategic transition into two independent entities (MetaMask for consumer platforms and Consensys focusing on protocols and institutional infrastructure), we are seeking an experienced Security Operations Center (SOC) Analyst to join our security organization. Consensys powers the core infrastructure driving the decentralized web, including Linea mainnet and the open-source Lineth ZK rollup stack recently donated to Linux Foundation Decentralized Trust. The SOC Analyst will be responsible for architecting, building, and operating a comprehensive 24/7 monitoring and alerting ecosystem across our entire digital asset footprint.
This role spans enterprise IT SaaS environments, core blockchain infrastructure, and Web3 smart contract security. The SOC Analyst will bridge traditional cybersecurity operations with cutting-edge Web3 threat detection, protecting our corporate IT stack (JumpCloud, AWS, Google Workspace, GitHub, Notion, Zoom), Linea mainnet infrastructure, and ecosystem DeFi protocols against emerging cyber threats and exploits using tools such as Hypernative, Hexagate, and Blockaid.

Requirements

• 3–5+ years of experience in Security Operations, Detection Engineering, or Incident Response within cloud-native or Web3 environments.
• Hands-on experience configuring and maintaining monitoring, threat detection, and incident analysis services for AWS (such as Amazon GuardDuty and AWS CloudTrail) and enterprise IT platforms (JumpCloud, Google Workspace, GitHub, Notion, and Zoom).
• Direct experience using Web3 security and onchain monitoring tools such as Hypernative, Hexagate, and Blockaid.
• Deep technical understanding of Ethereum, L2 scaling architectures, ZK-rollups (Lineth stack, Besu execution, prover systems), and smart contract vulnerabilities.
• Proficiency in log management, monitoring platforms (such as Grafana), SIEM/SOAR platforms, and scripting languages (Python, Go, Bash, or SQL).
• Familiarity with SOC2, ISO 27001, NIST, or SANS security frameworks.
• Strong communication, problem-solving, and analytical skills in a fast-paced, remote-first environment.

Responsibilities

• Architect and maintain centralized log collection, SIEM integration, and incident response services across AWS (utilizing Amazon GuardDuty and AWS CloudTrail) and corporate IT services including JumpCloud, Google Workspace, GitHub, Notion, and Zoom.
• Develop custom detection rules and alert logic to detect unauthorized access, privilege escalation, credential compromise, and anomalous user activity.
• Ensure complete security logging visibility, audit readiness, and access control management across all corporate platforms.
• Establish real-time security monitoring for Linea mainnet and the open-source Lineth ZK rollup stack (including Besu execution layer, Maru consensus, coordinator, and provers).
• Monitor RPC endpoints, sequencer performance, L1/L2 messaging reliability, state root finalization, and infrastructure telemetry.
• Collaborate with the DevOps team and core engineering teams to detect and mitigate infrastructure threats, DDoS attacks, and zero-day vulnerabilities.
• Implement and tune real-time Web3 threat monitoring platforms including Hypernative, Hexagate, and Blockaid.
• Build automated alerts to detect suspicious smart contract interactions, flash loan attacks, reentrancy exploits, liquidity drains, and unauthorized bridge activity on Linea mainnet.
• Perform onchain forensics and transaction trace analysis to safeguard ecosystem DeFi protocols and institutional assets.
• Serve as a primary responder for security alerts originating from IT SaaS, cloud infrastructure, and Web3 protocol layers, utilizing Grafana Cloud IRM to manage on-call rotations and incident management.
• Lead triage, investigation, containment, and post-mortem root cause analysis for confirmed security incidents.
• Proactively conduct threat hunting across system logs, cloud environments, and onchain transaction streams.
• Automate incident response playbooks and triage workflows using SOAR tools and custom scripts (Python, Go, Bash).
• Continuously refine detection rules to reduce false positives and improve Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
• Integrate automated containment mechanisms across access management, cloud IAM, and Web3 security providers.
• Maintain detailed incident records, forensic evidence, and documentation in alignment with SOC2 and ISO compliance frameworks.
• Prepare security operational metrics, alert volume analysis, and threat reports for leadership.
• Ensure compliance with corporate security policies and access controls across all environments.
• Monitor Web3 threat landscapes, tracking emerging smart contract exploit techniques and threat actors targeting L2 ecosystems.
• Coordinate with external security researchers, bug bounty programs, and Web3 security alliances to share intelligence.
• Participate in incident response drills, security reviews, and audit remediation with external security partners.

Benefits

• Competitive compensation package, including salary, benefits, and performance-based incentives.
• Meaningful equity
• The opportunity to safeguard cutting-edge Web3 and ZK-rollup infrastructure at the forefront of blockchain technology.
• A dynamic and collaborative work environment with a passionate and talented team.
• A platform to influence the future of decentralized technologies and financial systems.
• Competitive compensation
• Meaningful equity
• Chance to work on genuinely open source software at the frontier of web3.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed