Job Description
Our client, a Communications company, is looking for a SOC Analyst for their Herndon, VA location.
Responsibilities:
- Work in a fast-paced, SLA-driven Security Operations Center (SOC), using tools such as Splunk (SIEM) and ServiceNow to help identify and manage security incidents.
- This position is ideal for individuals looking to build a strong foundation in cybersecurity operations within a structured and process-driven environment, with opportunities for growth and skill development.
- Monitor security events and alerts using Splunk SIEM to identify suspicious activity across network, endpoint, and cloud environments.
- Perform initial triage and investigation of alerts, following defined procedures to determine severity and required actions.
- Respond to security incidents in accordance with established SLAs, ensuring timely escalation and proper handling.
- Use ServiceNow to log, track, and document incidents, maintaining accurate records throughout the lifecycle.
- Conduct basic threat research to stay informed on emerging threats, vulnerabilities, and attacker techniques.
- Support incident analysis by identifying contributing factors and assisting with remediation recommendations.
- Collaborate with security engineering, and threat hunting to resolve incidents and strengthen security controls.
- Follow and contribute to standard operating procedures (SOPs) and playbooks to ensure consistent incident response.
- Communicate clearly with internal stakeholders regarding incident status and actions taken.
- Support day-to-day operational activities within the team
- Perform technical and operational tasks aligned with business needs
- Work may involve hands-on operational support, troubleshooting, and maintenance-type responsibilities (inferred based on role title)
Requirements: - Seeking a motivated and detail-oriented SOC Analyst Level I to join our cybersecurity operations team. In this role, you will support continuous monitoring, detection, and initial response to security events across enterprise environments.
- Bachelor's degree in Cybersecurity, Information Technology, or a related field (or equivalent experience)
- Proficient understanding of SOC operations and the incident response lifecycle
- Familiarity with SIEM tool Splunk.
- Exposure to ServiceNow or similar ticketing systems
- Knowledge of networking fundamentals, security principles, and log analysis
- Strong analytical and problem-solving skills
- Ability to work in a 24x7 operational environment with strict SLA requirements
- Effective written and verbal communication skills
- Relevant certifications (e.g., CompTIA Security+, Splunk certifications)
- Familiarity with threat intelligence concepts or frameworks such as MITRE ATT&CK
- 2+ years of hands-on experience in security monitoring or incident response environments
- Candidates should be able to operate independently and contribute to ongoing operations
- Hands-on operational/technical environment involving troubleshooting, maintenance, and use of internal systems/tools in a structured, process-driven setting. Likely includes infrastructure/network-related support
- Team-oriented, fast-paced operational environment focused on safety, reliability, and collaboration, with a mix of independent work and team support
- A typical day includes reviewing work orders, performing hands-on troubleshooting and maintenance, monitoring systems, responding to issues, and documenting work while collaborating with the team
- Ramp-up includes onboarding and training in the first 1-2 weeks, with increasing independence over the first 30 days and full productivity expected within 30-60 days
- Must-Have Tools
- Splunk (Required):
- Hands-on experience with Splunk SIEM is mandatory; ~90% of the work will be performed within Splunk
- Candidates should have practical experience and/or Splunk certification
Why Should You Apply? - Health Benefits
- Referral Program
- Excellent growth and advancement opportunities
Job Tags