SOC Tier 3 Analyst

Global Alliant•Crownsville, MD

2d•Hybrid

About The Position

The SOC Tier 3 Analyst will be responsible for planning, initiating, and conducting forensic investigations on compromised systems. This role involves performing root cause and scope-of-impact analysis, creating detailed forensic reports, and supporting malware analysis of attacker tools and techniques. The analyst will also identify and analyze malicious payloads, train SOC analysts on SIEM tools like Sentinel, develop and tune detection rules, and assist in creating new SOC monitoring processes. Additionally, the position requires correlating actionable security events, reviewing threat data, developing custom detection signatures, and conducting threat hunting to identify advanced threats. The role also involves contributing to technical briefings, developing incident response procedures, and ensuring adherence to operational and technical standards. On-call support may be required outside regular hours or on weekends for critical incidents.

Requirements

Experience with SIEM tools (e.g., Sentinel)
Proficiency in malware analysis
Experience with threat intelligence and threat hunting
Ability to develop custom detection signatures
Experience in developing incident response procedures
Knowledge of operational and technical standards

Responsibilities

Plan, initiate, and conduct forensic investigations on compromised systems
Perform root cause and scope-of-impact analysis
Create detailed forensic reports
Support malware analysis of attacker tools and techniques
Identify and analyze malicious payloads
Train SOC analysts on SIEM tools (e.g., Sentinel)
Develop and tune detection rules
Assist in creating new SOC monitoring processes
Correlate actionable security events
Review threat data
Develop custom detection signatures
Conduct threat hunting to identify advanced threats
Contribute to technical briefings
Develop incident response procedures
Ensure adherence to operational and technical standards
Provide on-call support outside regular hours or on weekends to respond to critical incidents