In this role, you will be responsible for reviewing, monitoring, and evaluating SOC alerts and investigation outputs based on predefined scenarios and criteria. You'll differentiate true positives from false positives by validating investigative evidence and alert context, and perform comprehensive security investigations, including log analysis, entity pivoting, timeline reconstruction, and evidence correlation.

Responsibilities

• Review and evaluate SOC alerts and investigation outputs according to established criteria.
• Validate investigative evidence and alert context to distinguish true positives from false positives.
• Conduct end-to-end security investigations, including log analysis and evidence correlation.
• Assess the quality and completeness of SOC investigations produced by automated or human workflows.
• Apply consistent investigative judgment and recognize multiple valid investigation paths.
• Make binary determinations while producing detailed ground-truth investigations when required.
• Use Splunk to pivot across logs, entities, and timelines and reason about SPL queries.
• Maintain clear documentation of investigative steps, assumptions, evidence, and conclusions.
• Collaborate with program leads and other expert annotators to uphold investigation standards.
• Mentor or support other analysts as needed.

Requirements

• Hands-on experience as a SOC analyst in a production SOC environment.
• Strong understanding of alert triage and incident investigation workflows.
• Proficient in using Splunk for investigations and SPL query reasoning.
• Ability to pivot between logs, entities, and timelines.
• Proven capacity to evaluate SOC investigations and validate conclusions.
• Strong investigative judgment and decisiveness.
• Fluent in English with excellent documentation and communication skills.
• Experience with Endpoint Detection & Response tools like CrowdStrike Falcon or Microsoft Defender.
• Familiarity with analyzing cloud security logs from AWS, Azure, or GCP.
• Knowledge of Identity & Access Management platforms such as Okta.
• Experience with email security tools like Proofpoint or Mimecast.
• Leadership or mentoring experience in a SOC environment is a plus.
• Basic scripting skills (Python or similar).
• Relevant security certifications (e.g., GCIA, GCIH, Security+).

Application Process

• Upload your resume.
• Participate in a brief 15-minute interview.
• Complete the application form.

We look forward to your application and the opportunity to work together in enhancing cybersecurity.