SOC Analyst for AI-Driven Investigation Systems

This role applies hands-on SOC analyst judgment to review, validate, and construct high-quality security investigations across SIEM, endpoint, cloud, and identity data. You will evaluate automated and human-produced investigation outputs, perform end-to-end investigations when required, and help shape how SOC automation and AI-driven investigation systems interpret real-world alerts.

• Review, monitor, and evaluate SOC alerts and investigation outputs against predefined scenarios and acceptance criteria.
• Distinguish true positives from false positives by validating investigative evidence and alert context.
• Perform end-to-end security investigations as needed, including log analysis, entity pivoting, timeline reconstruction, and evidence correlation.
• Assess the correctness, completeness, and overall quality of SOC investigations produced by automated or human workflows.
• Apply consistent investigative judgment while recognizing that multiple valid investigation paths may exist for the same alert.
• Make clear binary determinations (for example, ACCEPT or PASS) and produce detailed ground-truth investigations when required.
• Use Splunk extensively to pivot across logs, entities, and timelines, including reading and reasoning about SPL queries.
• Maintain clear and accurate documentation of investigative steps, assumptions, evidence, and conclusions.
• Collaborate with program leads and other expert annotators to uphold investigation and annotation quality standards.
• Mentor or support other analysts where applicable, particularly in longer-term or lead annotator roles.

• 3+ years of hands-on experience as a SOC analyst in a production SOC environment, Tier 2 or above strongly preferred.
• Strong understanding of alert triage, incident investigation workflows, and evidence-based decision-making under time constraints.
• Mandatory hands-on experience with Splunk, including conducting investigations using Splunk, reading and understanding SPL queries, and pivoting between logs, entities, and timelines.
• Proven ability to evaluate SOC investigations and determine whether conclusions are valid, incomplete, or incorrect.
• Strong investigative judgment and comfort making decisive evaluations.
• Fluent English, written and spoken, with strong documentation and communication skills.

• Experience with Endpoint Detection and Response tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne.
• Experience analyzing cloud security logs and signals, for example AWS CloudTrail or GuardDuty, Azure Activity Log or Defender for Cloud, GCP Cloud Audit Logs.
• Familiarity with identity platforms such as Okta or Microsoft Entra ID (Azure AD).
• Experience with email security tools such as Proofpoint or Mimecast.
• SOC leadership or mentoring experience.
• Basic scripting experience, for example Python.
• Relevant security certifications such as GCIA, GCIH, GCED, Splunk certifications, Security+, CCNA, or cloud security certifications.

• Location: Remote
• Employment type: hourly
• Role is part of a talent network of vetted security professionals supporting SOC automation and investigation programs.

Hourly rate range: 70 - 95 hourly.

• Fluent English, written and spoken, is required.
• Must meet the qualifications above, including the mandatory Splunk experience and 3+ years of production SOC analyst experience.