Job Description

Role Overview

Help advance SOC automation and AI-driven investigation systems by applying real-world security operations expertise to validate alerts, assess investigation quality, and build reliable ground-truth cases across SIEM, endpoint, cloud, and identity environments.

Key Responsibilities

• Review, monitor, and evaluate SOC alerts and investigation outputs against defined scenarios and criteria.
• Validate evidence and alert context to distinguish true positives from false positives.
• Conduct end-to-end investigations as needed, including log analysis, entity pivoting, timeline reconstruction, and evidence correlation.
• Assess whether investigations produced through automated or human workflows are correct, complete, and high quality.
• Apply consistent investigative judgment while recognizing that an alert may have more than one valid investigation path.
• Make clear binary determinations, such as accept or pass, and produce detailed ground-truth investigations when required.
• Use Splunk extensively to pivot across logs, entities, and timelines, including reading and reasoning about SPL queries.
• Document investigative steps, assumptions, evidence, and conclusions clearly and accurately.
• Collaborate with program leads and fellow expert annotators to maintain strong investigation and annotation standards.
• Mentor or support other analysts when applicable, particularly in long-term or lead annotator assignments.

Qualifications

• At least 3 years of hands-on experience as a SOC analyst in a production SOC environment. Tier 2 or higher experience is strongly preferred.
• Strong knowledge of alert triage, incident investigation workflows, and evidence-based decision-making under time constraints.
• Hands-on Splunk experience, including conducting investigations, reading and reasoning about SPL queries, and pivoting among logs, entities, and timelines.
• Demonstrated ability to evaluate SOC investigations and determine whether conclusions are valid, incomplete, or incorrect.
• Sound investigative judgment and confidence making decisive evaluations.
• Fluent written and spoken English, with strong documentation and communication skills.

Preferred Qualifications

• Experience with EDR tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne.
• Experience analyzing AWS CloudTrail and GuardDuty, Azure Activity Log and Defender for Cloud, or GCP Cloud Audit Logs.
• Familiarity with identity and access management platforms such as Okta Identity Cloud or Microsoft Entra ID.
• Experience with email security tools such as Proofpoint or Mimecast.
• SOC leadership or mentoring experience.
• Basic Python or similar scripting experience.
• Optional security certifications, including GCIA, GCIH, GCED, Splunk certifications, Security+, CCNA, or cloud security certifications.

Work Terms

• Remote hourly engagement.

Compensation

• $70 to $95 per hour.

Opportunity

• Contribute to high-impact investigative evaluations and security cases while collaborating with SOC practitioners, security engineers, and AI teams.
• Apply practical SOC expertise to help shape how future security teams investigate and respond to threats.

Job Tags

Similar Jobs