SOC Mid-Level Analyst

ECS Federal•NEW YORK, NY

1d•$120,000 - $145,000•Remote

About The Position

ECS is seeking a remote Mid-Level SOC Analyst to support the development of processes, procedures, and automations for rapidly ingesting, aggregating, correlating, normalizing, and analyzing event messages to identify and respond to Indicators of Compromise (IoCs). The role requires experience in a mature 24x7x365 Security Operations Center. The schedule is Sunday through Thursday, 12:00 AM–8:00 AM ET, subject to change. The analyst monitors security events across SIEM and on-premises infrastructure and cloud applications, participates in critical incident response, supports containment, remediation, and recovery, and contributes to post-incident reviews. The role also includes SIEM alert tuning, SOAR playbook and workflow development, proactive threat hunting, collaboration with Cyber Threat Intelligence, and research and reporting on security events and threats. The salary range is $120,000–$145,000. The posting references benefits but does not specify individual benefits.

Requirements

At least 5 years of experience conducting log data analysis in support of intrusion analysis or information security operations.
Bachelor’s degree or equivalent, with relevant certifications.
Experience with two or more analysis tools used in a CIRT or similar investigative environment.
Ability to build content in a SIEM system.
Ability to analyze and triage IoCs.
Experience working in a mature 24x7x365 Security Operations Center.

Responsibilities

Continuously monitor SIEM and on-premises infrastructure and cloud applications for security events, including the SIEM alert queue, phishing email inbox, intelligence feeds, and incident ticketing queue.
Participate in responding to and handling critical incident activity.
Ensure proper execution of containment, remediation, and recovery activities.
Assess and document lessons learned during post-incident reviews, including unsuccessful controls, outdated procedures, and incomplete remediation actions.
Coordinate with SIEM engineering to tune security events and alerts and improve alert fidelity.
Assist with creating and tuning SOAR playbooks and automated workflows.
Conduct proactive threat hunting to identify and characterize emerging threats, vulnerabilities, and risks.
Work with Cyber Threat Intelligence to provide information on detection patterns for upcoming threats.
Compile and disseminate threat hunt reports to SOC leadership as requested.
Research and document cybersecurity events of interest.