Senior Security Operations Center Analyst, Absolute Security

• We are seeking a highly skilled and experienced Senior SOC Analyst to join our Security Operations Center
• The ideal candidate will have deep expertise in CrowdStrike Falcon, Microsoft Sentinel, and a strong understanding of network and operating system internals across Windows, Linux, and macOS. Experience in cloud incident investigations (Azure, AWS, GCP) is essential
• 4–7 years of experience in a SOC or cybersecurity analyst role
• Expert-level proficiency with CrowdStrike Falcon and Microsoft Defender
• Strong understanding of MITRE ATT&CK, malware behaviors, and incident response
• Hands-on experience with SIEM platforms (e.g., Splunk, Sentinel, Elastic)
• Deep knowledge of Windows, Linux, and macOS internals
• Proficiency in scripting (Python, PowerShell) and log analysis
• Excellent written and verbal communication skills
• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or equivalent experience

Desirable

• This role is pivotal in defending enterprise assets against advanced threats through proactive monitoring, threat hunting, and incident response
• Department: Security Operations. Reports To: Director, Security Operations
• Monitor and triage alerts from CrowdStrike Falcon and Microsoft Sentinel
• Lead investigations into endpoint and network security incidents including malware, privilege escalation, lateral movement, and data exfiltration
• Execute containment and remediation strategies for identified threats
• Conduct proactive threat hunts using CrowdStrike telemetry and threat intelligence
• Perform forensic analysis of compromised systems and malware samples
• Analyze network logs and packet captures to identify anomalies and attacker behavior
• Investigate cloud-based incidents across Azure, AWS, and GCP environments
• Assess cloud logging readiness and ensure audit trails are complete and actionable
• Collaborate with cloud operations teams to improve detection and response capabilities
• Develop and refine playbooks, runbooks, and standard operating procedures
• Tune SIEM rules and EDR policies to reduce false positives and improve alert fidelity
• Participate in red/blue team exercises and contribute to continuous SOC maturity
• Serve as an escalation point for Tier 1 and Tier 2 analysts
• Mentor junior SOC staff and contribute to team knowledge sharing
• Interface with threat intelligence, incident response, and executive stakeholders