- Company Name
- Sorenson Communications
- Job Title
- Senior SOC Analyst
- Job Description
-
Job Title: Senior SOC Analyst
Role Summary:
Lead and oversee security operations center (SOC) activities, driving threat monitoring, incident response, and investigative processes. Design and maintain SOC/IP workflows, playbooks, and automation to enhance detection, containment, and remediation across on‑prem, cloud, and endpoint environments. Assess MSSP performance, tune controls, and validate security technologies to sustain a robust security posture.
Expectations:
* Govern SOC operations, ensuring effective collaboration with internal teams and MSSP partners.
* Design and update IR frameworks, playbooks, and runbooks aligned with industry best practices.
* Leverage threat intelligence, MITRE ATT&CK, and NIST CSF to identify and close detection gaps.
* Lead forensic, malware, and threat‑hunting investigations, reporting actionable insights.
* Drive continuous improvement of tools, rules, and processes through automation and SOAR.
Key Responsibilities:
- Oversee SOC and incident response workflows, including triage, containment, eradication, and recovery.
- Define and manage escalation procedures and SLAs with MSSP and internal stakeholders.
- Implement and maintain SIEM, SOAR, and EDR playbooks and runbooks; auto‑response to accelerate MTTR.
- Monitor logs, alerts, and endpoint detections across platforms (Splunk, Elastic, DataSet, SentinelOne, CrowdStrike, Defender ATP).
- Conduct investigations, root‑cause analysis, forensic analysis, malware reverse engineering, and threat hunting.
- Integrate external threat intelligence feeds into monitoring tools and refine detection rules.
- Report incident trends, SOC effectiveness metrics (MTTD, MTTR), and recommended remediation to executive audience.
- Support vulnerability scanning, patch compliance, firewall rule reviews, and cloud security assessments.
- Evaluate, test, and integrate new security tools into SOC workflows.
- Participate in red/blue teaming and incident‑response exercises.
Required Skills:
- 7+ years in security operations, threat detection, and incident response.
- 3+ years leading investigations and coordinating response teams.
- 3+ years managing/MSSC oversight and ensuring quality of monitoring.
- Advanced proficiency in SIEM solutions (Splunk, Elastic, DataSet).
- Deep knowledge of EDR platforms (SentinelOne, CrowdStrike, Defender ATP).
- Familiarity with vulnerability management tools (Rapid7, similar).
- Scripting abilities in Python, PowerShell, Bash for automation.
- Mastery of MITRE ATT&CK, NIST CSF, and incident‑response frameworks.
- Strong understanding of network security, cloud security configurations, firewall rule review, and SOAR platform utilization.
Required Education & Certifications:
- Bachelor’s degree in Computer Science, Information Security, or related field.
- Certifications: CompTIA Security+, CEH, GCIH, GCIA, CISSP, CISM, SOC Analyst‑focused credentials; AWS or Azure security certifications preferred.
Salt lake city, United states
Hybrid
Senior
25-01-2026