Security - SOC Analyst Sr

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience
• 6+ years of experience in cybersecurity, including at least 4 years in SOC, incident response, or threat hunting roles
• Demonstrated experience leading response to complex, high-severity incidents from detection through recovery
• Advanced proficiency with SIEM and EDR platforms, including complex query development (e.g., Splunk SPL) and detection engineering
• Deep knowledge of Windows, Linux, Active Directory, and cloud attack techniques, including persistence, privilege escalation, and lateral movement
• Hands-on experience with digital forensics (memory, disk, and log analysis) and malware analysis
• Proficiency in Python or PowerShell for automation, data analysis, and tooling
• Proven ability to mentor analysts and communicate technical findings to executives and non-technical stakeholders
• Ability to make sound decisions under pressure and act as technical lead during critical incident willingness to participate in on-call rotation as the senior escalation resource
• Experience with scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense Operation and Investigation
• Ability to develop, execute queries (e.g., SPL, XQL) and scripts (Python, PowerShell) using VS Code for log analysis, and automated simulation of security scenarios to validate detection rules
• Experience monitoring deployed detections for failures, query errors, and logic gaps; investigate detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.
• Preferred Qualifications
• Industry certifications such as CISSP, GIAC GCFA, GCIH, GREM, GCTI, or OSCP
• Experience developing Cortex XSOAR content and implementing risk-based alerting in Splunk ES
• Experience responding to incidents in cloud environments (AWS, Azure, or Google Cloud) and Microsoft 365
• Experience planning or running purple team and adversary emulation exercises
• Experience in retail, payments, or PCI DSS-regulated environments, including familiarity with breach notification requirements
• Prior experience as an incident commander, SOC shift lead, or team lead