This job is closed
Applications are no longer available for this announcement. Explore current related opportunities below.
Job description
Role Overview
Help advance SOC automation and AI-driven investigation systems by applying real-world security operations expertise to validate alerts, assess investigation quality, and build reliable ground-truth cases across SIEM, endpoint, cloud, and identity environments.
Key Responsibilities
Review, monitor, and evaluate SOC alerts and investigation outputs against defined scenarios and criteria.
Validate evidence and alert context to distinguish true positives from false positives.
Conduct end-to-end investigations as needed, including log analysis, entity pivoting, timeline reconstruction, and evidence correlation.
Assess whether investigations produced through automated or human workflows are correct, complete, and high quality.
Apply consistent investigative judgment while recognizing that an alert may have more than one valid investigation path.
Make clear binary determinations, such as accept or pass, and produce detailed ground-truth investigations when required.
Use Splunk extensively to pivot across logs, entities, and timelines, including reading and reasoning about SPL queries.
Document investigative steps, assumptions, evidence, and conclusions clearly and accurately.
Collaborate with program leads and fellow expert annotators to maintain strong investigation and annotation standards.
Mentor or support other analysts when applicable, particularly in long-term or lead annotator assignments.
Qualifications
At least 3 years of hands-on experience as a SOC analyst in a production SOC environment. Tier 2 or higher experience is strongly preferred.
Strong knowledge of alert triage, incident investigation workflows, and evidence-based decision-making under time constraints.
Hands-on Splunk experience, including conducting investigations, reading and reasoning about SPL queries, and pivoting among logs, entities, and timelines.
Demonstrated ability to evaluate SOC investigations and determine whether conclusions are valid, incomplete, or incorrect.
Sound investigative judgment and confidence making decisive evaluations.
Fluent written and spoken English, with strong documentation and communication skills.
Preferred Qualifications
Experience with EDR tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne.
Experience analyzing AWS CloudTrail and GuardDuty, Azure Activity Log and Defender for Cloud, or GCP Cloud Audit Logs.
Familiarity with identity and access management platforms such as Okta Identity Cloud or Microsoft Entra ID.
Experience with email security tools such as Proofpoint or Mimecast.
SOC leadership or mentoring experience.
Basic Python or similar scripting experience.
Optional security certifications, including GCIA, GCIH, GCED, Splunk certifications, Security+, CCNA, or cloud security certifications.
Work Terms
Remote hourly engagement.
Compensation
$70 to $95 per hour.
Opportunity
Contribute to high-impact investigative evaluations and security cases while collaborating with SOC practitioners, security engineers, and AI teams.
Apply practical SOC expertise to help shape how future security teams investigate and respond to threats.
Who can apply
Review the original listing for work authorization, qualifications and employer requirements.