SOC Analyst I (Microsoft Sentinel)

Location: Fully remote; standard business hours are Monday through Friday, 8:30 AM to 5:30 PM, with willingness to work shifts and on-call rotations in a 24/7 environment.

What you will do

• Monitor security events and alerts using Microsoft Sentinel, Defender technologies, and Log Analytics.
• Identify and triage potential security threats using threat intelligence and log analysis.
• Provide initial incident analysis, support response efforts, and escalate incidents to senior analysts when needed.
• Use KQL queries to investigate threats and derive security insights.
• Collaborate with SOC colleagues and stakeholders to resolve incidents and improve the security posture.
• Identify trends and anomalies and contribute to continuous improvement of security operations.

Requirements

• Willingness to work in a 24/7 environment, including shifts and on-call rotations.
• Developing knowledge of Microsoft Sentinel for SIEM and SOAR concepts, including Azure Sentinel detection and response capabilities.
• Developing proficiency in KQL queries and basic log-analysis investigations.
• Familiarity with threat intelligence, suspicious-activity identification, and basic threat hunting.
• Understanding of the MITRE ATT&CK framework and NIST-based incident response procedures.
• Interest in the requirements and procedures associated with working in government environments.

Culture & Benefits

• Fully remote, full-time position.
• Standard working hours are Monday through Friday, 8:30 AM to 5:30 PM.
• Participation in shifts and on-call rotations may be required to support a 24/7 SOC environment.