Senior SOC Analyst (Cybersecurity)

Location: Hybrid work from the Fairfax, VA office for up to 3 days per week; additional onsite support may be required based on operational or mission needs.

Salary: $130,000–$150,000 per year

Company

hirify.global operates in the cybersecurity and technology services space.

What you will do

• Serve as the primary SOC resource for a new unclassified AWS environment.
• Build, configure, tune, and improve SIEM queries, correlation rules, alerts, dashboards, reports, and detection content.
• Monitor and investigate alerts, notable events, indicators of compromise, anomalous activity, and potential cybersecurity incidents.
• Own confirmed incidents through detection, analysis, containment, eradication, recovery, closure, and post-incident review.
• Coordinate incident response with cybersecurity, cloud, network, systems, application, and other technical teams.
• Develop SOC documentation, metrics, automation opportunities, after-action reports, and provide technical guidance to junior analysts.

Requirements

• U.S. citizenship is required.
• Ability to obtain Secret clearance is required; active clearance is preferred.
• Active DoD 8140 IAT Level II Security+ certification or higher is required.
• Ability to work up to 3 days per week in a hybrid capacity from Fairfax, VA, with additional onsite support as needed.
• 8+ years of cybersecurity experience, including 4+ years in a SOC environment.
• Strong experience with SIEM technologies, including queries, correlation rules, alerts, dashboards, reports, and detection logic.
• Ability to independently triage and investigate complex alerts, anomalous activity, and potential incidents, and manage incidents through the full response lifecycle.
• Direct experience with AWS security monitoring and incident response, including CloudTrail, CloudWatch, VPC Flow Logs, GuardDuty, IAM activity, and related telemetry.
• Strong understanding of Windows, Linux, networking, cloud infrastructure, endpoint security, applications, identity, and authentication.
• Experience correlating endpoint, network, identity, cloud, application, and operating-system telemetry; onboarding and validating log sources; analyzing Entra ID, Active Directory, or similar identity activity; and analyzing IoCs, CVEs, suspicious authentication activity, and TTPs.
• Experience conducting proactive threat hunts, developing or tuning detections, and maintaining SOC procedures, incident-response playbooks, runbooks, escalation processes, and operational workflows.
• Working knowledge of MITRE ATT&CK or similar frameworks and experience applying them to investigations, detection development, and threat hunting.
• Ability to lead technical incident response, coordinate multiple technical teams, independently manage SOC operations, and prioritize alerts, investigations, incidents, and operational requirements.
• Strong problem-solving, decision-making, interpersonal, and written and oral communication skills.

Culture & Benefits

• Full-time position within the Cybersecurity department.
• Hybrid work arrangement with operationally driven onsite support requirements.
• Benefits information is provided through the hirify.global careers benefits program.