SOC Analyst

Our client is looking for a SOC Analyst to join their IT department and oversee security operations across their endpoints, cloud systems, and identity infrastructure. They are a prominent full-service legal practice that has recently been recognized among the top employers in their region for workplace excellence and continued organizational growth. Reporting to the IT Director, this hands-on operator will serve as the central point of contact for cybersecurity, collaborating closely with a Managed Security Service Provider (MSSP) and internal IT personnel to validate alerts, contain threats, drive tickets to closure, and strengthen security policies and controls.

• Monitor, triage, and respond to security alerts generated by the MSSP, XDR platforms (including SentinelOne and Windows Defender), and additional security tools across endpoints, identity, and cloud systems.
  
• Quickly validate security detections by distinguishing between false positives and true positives, assessing the scope of impact, and thoroughly documenting all supporting evidence.
  
• Take full end-to-end ownership of security tickets by categorizing, prioritizing, escalating as needed, and driving issues to complete closure with clear timelines and detailed notes.
  
• Coordinate threat containment measures with the internal IT team—such as isolating endpoints, executing account actions, and blocking malicious indicators—in alignment with established incident response procedures and severity guidelines.
  
• Strengthen security configurations within Microsoft 365 and endpoint detection and response (EDR) environments.
  
• Analyze trends across alerts and security incidents to recommend and implement approved policy and control adjustments that mitigate risk and reduce recurring alert noise, including tuning detection logic, tightening access controls, and updating security standards.
  
• Maintain, refine, and update SOC playbooks and incident response documentation as new threat patterns emerge.
  
• Prepare concise, decision-ready weekly and monthly security reports for the IT Director covering incident summaries (events, impact, and remediation), alert volumes and categories, response times, closure quality, control gaps, and recommended fixes.
  
• Support ongoing continuous improvement initiatives focused on endpoint telemetry, security monitoring, and incident response workflows.
  

• 2+ years of hands-on professional experience in a SOC analyst, security monitoring, or incident response role.
  
• Demonstrated experience triaging security alerts and managing tickets from initial detection through final resolution rather than solely monitoring dashboards.
  
• Hands-on experience with Microsoft Defender, Microsoft Sentinel, and/or SentinelOne, alongside Microsoft 365 security administration.
  
• Solid knowledge of SIEM, EDR, firewall, and network security technologies.
  
• Practical understanding of endpoint detection and response (EDR) concepts and common cyberattack patterns.
  
• Exceptional written documentation habits with the proven ability to construct clear, defensible incident timelines and comprehensive remediation notes.
  
• Strong verbal and written English proficiency to communicate security risks in plain language to IT leadership and non-technical stakeholders.
  
• Active cybersecurity certification (or earned within the last 3 years) from at least one of the following: CompTIA Security+, CompTIA CySA+, Microsoft SC-200 (Security Operations Analyst), GIAC (entry to mid-level options), or an equivalent recognized security credential.
  

• Direct hands-on experience with SentinelOne alert triage and incident response workflows.
  
• Prior experience collaborating alongside an MSSP, managing alert escalations, and fulfilling evidence requests.
  
• Background working within a law firm, financial institution, or professional services environment where strict confidentiality and chain-of-custody discipline are critical.
  
• Experience drafting, reviewing, or updating cybersecurity policies and standards based on lessons learned from security incidents.
  
• Familiarity with scripting or automation tools, such as PowerShell or Python, to accelerate alert triage and evidence collection.
  

• Full-time, 100% remote position.
  
• Consistent working schedule from 9:00 AM to 6:00 PM Eastern Time, with approximately one hour of flexibility in either direction.
  
• Opportunity for long-term stability with potential to transition to a direct hire role in the future.