SOC Tier 3 Analyst

Global Alliant•Glen Burnie, MD

1d•Hybrid

About The Position

The SOC Tier 3 Analyst supports Security Operations Center monitoring, incident response, and cybersecurity program development. The role investigates compromised systems and potential cyber incidents, performs forensic and root-cause analysis, and produces detailed forensic reports. It also contributes technical expertise to cybersecurity projects, monitoring tools, and SOC processes, while supporting Tier 1 and Tier 2 analysts. This is a hybrid position based in Crownsville, Maryland. The analyst must work at the Crownsville office two to three times per week or follow a rotation schedule with other Tier 3 Analysts. U.S. citizenship is required because of federal regulations and the sensitive nature of the work. The role may require availability outside regular hours or on weekends for critical incidents.

Requirements

U.S. citizenship is required due to federal regulations and the sensitive nature of the work.
Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related technical or scientific discipline.
10 or more years of relevant experience in cybersecurity, digital forensics, or incident response.
Proficiency with forensic tools.
Experience with SIEM platforms, including Sentinel.
Malware analysis skills.
Network traffic analysis skills.
Threat intelligence gathering skills.
Strong leadership and communication skills.
Ability to work at the Crownsville office two to three times per week or follow a rotation schedule with other Tier 3 Analysts.

Nice To Haves

GREM, CEH, CHFI, GCFE, GIAC, or similar cybersecurity or forensics credentials are preferred.

Responsibilities

Plan, initiate, and conduct forensic investigations on compromised systems.
Perform root-cause and scope-of-impact analysis and create detailed forensic reports.
Support analysis of malware, attacker tools, techniques, and malicious payloads.
Train SOC analysts on SIEM tools, including Sentinel.
Develop and tune detection rules and help create SOC monitoring processes.
Correlate actionable security events, review threat data, develop custom detection signatures, and conduct threat hunting.
Contribute to technical briefings and develop incident response procedures.
Ensure adherence to operational and technical standards.
Assist with development of SOC tiered monitoring and escalation processes.
Provide support to SOC Tier 1 and Tier 2 personnel.
Provide technical expertise for cybersecurity projects and initiatives, including endpoint protection and response, vulnerability management, and security operations expansion.
Provide technical expertise and support for cybersecurity monitoring and analysis tool engineering and implementation.
Review, evaluate, and triage security alerts in Sentinel using dashboards, reports, and custom queries.
Investigate possible cyber incidents using captured network traffic, intrusion detection software, and Sentinel instrumentation.
Perform other assigned security program development, documentation, security monitoring, threat hunting, vulnerability management, technical and risk assessment, and security engineering duties.
Respond to critical incidents when needed outside regular hours or on weekends.