SOC Security Analyst L3

BlueVoyant•Maryland City, MD

2d•Hybrid

About The Position

BlueVoyant is seeking a SOC Security Analyst L3 to defend global customers against evolving adversary activity. As the senior technical expert and escalation point for the team, the analyst handles active intrusions, leads complex investigations, and ensures client attacks are handled urgently and accurately with clear communication. The role includes mentoring junior analysts, advising clients, and contributing to technology strategy and process improvement. It reports to SOC leadership and operates under BlueVoyant processes, tooling, and supervision, including when working in client environments. The position is based in a hybrid work environment in Maryland and requires U.S. citizenship for work on certain federal contracts. The schedule is four 10-hour shifts, either Wednesday through Saturday or Sunday through Tuesday; exact shift times are to be determined. The analyst works across BlueVoyant-managed systems and client-provided environments, following approved access controls, logging, operating procedures, and security policies. BlueVoyant describes the role as an opportunity to serve as a senior technical authority in a global SOC, lead investigations into real-world intrusions, mentor team members, and influence detection, process, and technology strategy. The company offers competitive compensation and a comprehensive benefits package with support for wellbeing, development, and career growth.

Requirements

Ability to handle high-pressure situations productively and professionally.
Advanced written and verbal communication skills, including explaining complex technical topics clearly.
Strong teamwork and interpersonal skills, including effectiveness in a globally distributed team.
Ability to work directly with clients to understand requirements and gather feedback on security services.
Knowledge and experience with SIEM solutions, Cloud App Security tools, and EDR.
Experience creating SIEM/EDR detections.
Expertise in endpoint, web, and authentication log analysis.
Advanced knowledge of network protocols, network telemetry, and commonly abused protocols.
Experience responding to modern authentication attacks involving Active Directory, Entra ID, OAuth, and SSO.
Expert knowledge of common attack paths, including LOLBin use, common adversary tools, business email compromise (BEC), and AiTM attacks, including identification and response.
Strong knowledge of SIEM workflows; Microsoft Sentinel and Splunk are preferred.
Strong knowledge of malware detection, including dynamic and light static analysis, Windows PE analysis, and maldoc analysis.
Strong knowledge of network monitoring metadata, including web logs, firewall logs, and WAF/IDS.
Strong knowledge of email security and common BEC attacks.
Strong knowledge of Windows and Unix forensic artifacts, such as registry analysis and wtmp/btmp.
Strong knowledge of remote access solutions, both legitimate and inherently malicious.
Strong knowledge of lateral movement methodologies and tools for Windows- and Unix-based operating systems.
Strong knowledge of Microsoft 365 attack paths and common attacker methodologies.
Strong knowledge of credential-harvesting tools and methodologies.
Bachelor's degree in Information Security, Computer Science, or another IT-related field, or equivalent professional experience.
U.S. citizenship is required for work on some federal contracts; all employees must be authorized to work in the United States.

Nice To Haves

Background in intrusion analysis, incident response, digital forensics, penetration testing, or a related area.
Five or more years of hands-on SOC/TOC/NOC experience.
Experience countering ransomware threat actors and operations.
Familiarity with Microsoft Sentinel, Splunk, the Microsoft Defender suite, CrowdStrike Falcon, and SentinelOne.
Familiarity with GPO, LANDesk, or other IT infrastructure tools.
Understanding of one or more programming languages, such as Python, JavaScript, Lua, Ruby, GoLang, or Rust.
Relevant certifications such as GIAC certifications (strongly preferred), CISSP, Security+, Network+, CEH, RHCA, RHCE, MCSA, MCP, or MCSE.

Responsibilities

Monitor and analyze security events and alerts from SIEM logs, endpoint logs, EDR telemetry, and other sources.
Serve as the technical escalation point for active intrusions and escalations from junior analysts.
Lead complex investigations, declare incidents, and perform live-response analysis of compromised endpoints.
Research indicators and activities to assess reputation and suspicious characteristics.
Analyze malware, attacker network infrastructure, and forensic artifacts.
Hunt for suspicious activity using anomalous behavior and curated threat intelligence.
Ensure events are properly identified, analyzed, and escalated as incidents.
Participate in responding to, investigating, and resolving security incidents, engaging BlueVoyant Incident Response teams for active intrusions.
Produce clear investigation, handling, and response documentation with defined remediation actions for clients.
Communicate with clients about incidents and support remediation.
Identify and tune false-positive or benign detections.
Perform peer review and quality assurance of junior analyst investigations and mentor lower-level analysts.
Help advance security policies, procedures, and automation.
Support the Customer Success team with client engagements when required.
Operate across BlueVoyant-managed systems and client-provided environments in accordance with approved access controls, logging, operating procedures, and security policies, maintaining strict separation.