SOC Analyst

Booz Allen Hamilton•Fort Meade, MD

3d•$69,400 - $158,000•Remote

About The Position

The Opportunity: Are you an experienced cybersecurity analyst who enjoys digging deeper than the alert? Do threat hunting, complex investigations, and finding the activity others miss interest you? Join a team of advanced cybersecurity analysts working to protect the systems that support one of the world’s most critical hubs for global trade and supply chain operations. As a Tier III Security Operations Center Analyst, you’ll apply deep technical expertise within a 24×7 SOC to identify and respond to sophisticated cyber threats. You’ll conduct intelligence-driven threat hunting, investigate complex and high-priority cybersecurity events, and perform advanced technical analysis, including malware triage, digital forensics, network analysis, and investigation of anomalous activity. You’ll use Microsoft Sentinel, KQL, threat intelligence, and security telemetry across endpoint, network, cloud, and operational technology environments to understand adversary activity and identify threats that may bypass automated detections. You’ll also help continuously improve the SOC’s detection and response capabilities by developing and tuning detection use cases, correlation rules, alerts, and queries, identifying false positives and detection gaps, and improving playbooks and investigative processes. As a senior technical member of the SOC, you’ll serve as an escalation point and mentor to Tier I and Tier II analysts, collaborate with technical SMEs and client stakeholders during investigations, and translate complex technical findings into clear risks, impacts, and recommended actions. You’ll also support structured shift handoffs to maintain situational awareness and operational continuity across the 24×7 SOC. Join us. The world can’t wait.

Requirements

3+ years of experience with cybersecurity, including SOC operations, incident response, threat hunting, or detection engineering
Experience with Microsoft Sentinel and KQL
Experience with SIEM detection engineering, tuning, and security investigations
Knowledge of malware analysis, digital forensics, networking, and cloud security concepts
Knowledge of scripting languages such as Python
Knowledge of MITRE ATT&CK, NIST SP 800-53, and NIST SP 800-82
Secret clearance
HS diploma or GED

Nice To Haves

Experience supporting critical infrastructure, operational technology, or industrial control system environments
Experience with Red Canary or similar MDR capabilities
Microsoft Certified: Security Operations Analyst Associate, GCIH, GSOC, GICSP, GRID, GCIA, CCNA, CISSP, or similar Certification

Responsibilities

Apply deep technical expertise within a 24x7 SOC to identify and respond to sophisticated cyber threats.
Conduct intelligence-driven threat hunting.
Investigate complex and high-priority cybersecurity events.
Perform advanced technical analysis, including malware triage, digital forensics, network analysis, and investigation of anomalous activity.
Use Microsoft Sentinel, KQL, threat intelligence, and security telemetry across endpoint, network, cloud, and operational technology environments to understand adversary activity and identify threats that may bypass automated detections.
Continuously improve the SOC’s detection and response capabilities by developing and tuning detection use cases, correlation rules, alerts, and queries.
Identify false positives and detection gaps.
Improve playbooks and investigative processes.
Serve as an escalation point and mentor to Tier I and Tier II analysts.
Collaborate with technical SMEs and client stakeholders during investigations.
Translate complex technical findings into clear risks, impacts, and recommended actions.
Support structured shift handoffs to maintain situational awareness and operational continuity across the 24x7 SOC.