We are seeking a skilled SOC Investigation Specialist to join our Talent Network. This remote position offers flexible commitment between 10 to 40 hours per week. You will play a crucial role in reviewing and evaluating SOC alerts and investigation outputs, ensuring the integrity of our security operations.

The Role

You will be responsible for conducting thorough security investigations, including log analysis and evidence correlation, and distinguishing true positives from false positives. Your expertise will help maintain the quality of SOC investigations and support other analysts as needed.

Responsibilities

• Review, monitor, and assess SOC alerts and investigation outputs based on set criteria.
• Validate investigative evidence to differentiate true positives from false positives.
• Conduct end-to-end security investigations involving log analysis, entity pivoting, and timeline reconstruction.
• Evaluate the accuracy and quality of SOC investigations produced by both automated and human workflows.
• Utilize Splunk for log pivoting and to analyze SPL queries.
• Document investigative steps, assumptions, evidence, and conclusions clearly.
• Collaborate with program leads and other experts to maintain investigation standards.
• Mentor or support fellow analysts when applicable.

Requirements

• Proven experience as a SOC analyst in a production environment.
• Strong understanding of alert triage and incident investigation workflows.
• Hands-on experience with Splunk for investigations and SPL query analysis.
• Ability to pivot across logs, entities, and timelines effectively.
• Strong investigative judgment and decision-making skills.
• Fluent in English with excellent documentation and communication abilities.
• Experience with Endpoint Detection & Response tools (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne).
• Familiarity with cloud security logs (AWS, Azure, GCP).
• Knowledge of Identity & Access Management platforms (Okta, Microsoft Entra ID).
• Experience with email security tools (Proofpoint, Mimecast).
• Leadership or mentoring experience in a SOC environment.
• Basic scripting skills (Python or similar).
• Relevant security certifications (e.g., GCIA, GCIH, Splunk certifications, Security+, CCNA, cloud security certifications).

Application Process

The application process is straightforward and takes about 20 minutes. Please upload your resume and participate in a brief 15-minute interview before submitting your application form. We look forward to your application and the possibility of you joining our team!