SOC-Analyst, Security-Analyst, Cybersecurity-Analyst Jobs

This is a remote position.

Originally posted on Himalayas

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation. We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We’re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you.

About the Role:

CrowdStrike is looking for highly motivated, self-driven, technical analysts dedicated to making a difference in global security by protecting organizations against the most advanced attackers in the world. Our CrowdStrike virtual security operations center offers opportunities to expand your skill set through a wide variety of experiences, detecting and responding to incidents as they occur in real-time for our customers.

This role is open to candidates located in either PST or MST timezones.

Am I an Associate Analyst, Endpoint Protection Team Candidate?

• Do you have a passion for cybersecurity and a strong desire to build a career protecting organizations from the world's most sophisticated threats?
• Are you self-motivated and looking for an opportunity to rapidly accelerate your skills?
• Do you crave new and innovative work that actually matters to your customer?
• Do you have a foundational background in Information Technology or Information Security that you're ready to put to work?
• Do you excel at communicating clearly and professionally with customers and colleagues?
• Do you love working around like-minded, smart people who you can learn from on a daily basis?
• Are you excited about the evolving role of AI in security operations, including AI models, prompt engineering, and agentic SOC workflows?

What You'll Do:

• Deliver clear, concise, and professional customer communications as the primary first point of contact.
• Produce high-quality written and verbal communications, recommendations, and findings to customers and internally.
• Triage, investigate, and respond to security alerts across endpoint, identity, email, and cloud environments.
• Conduct tactical analysis of EDR telemetry, log sources, and forensic artifacts to identify the scope of compromise and support remediation efforts.
• Investigate suspicious Microsoft 365 activity, including business email compromise (BEC) and adversary-in-the-middle (AITM) attacks, contain the threat, and deliver actionable guidance to customers.
• Develop and improve processes for incident detection and the execution of countermeasures.

What You'll Need:

Successful candidates will have training or knowledge in one or more of the following areas:

• Incident Handling: training or foundational knowledge in incident response processes, including the investigation of security events such as targeted threats, malware infections, and unauthorized access.
• Threat Landscape Awareness: foundational knowledge of attack vectors, threat actor tactics, techniques, and procedures (TTPs), including familiarity with frameworks such as MITRE ATT&CK.
• Operating System Fundamentals: understanding of Windows, Mac, and Linux operating systems, including typical Windows functionality such as the file system, registry, scheduled tasks, and running processes.
• Systems Administration: experience administering a network and troubleshooting issues such as general connectivity and authentication issues. Has an understanding of general IT architecture configurations in small to large networks.
• Network Analysis Fundamentals: knowledge of network protocols, network analysis tools, and ability to perform analysis of associated network logs.
• Identity Platform Awareness: familiarity with identity and access management platforms such as Okta, Microsoft Entra ID, Active Directory, and similar technologies commonly found in enterprise environments.
• Email Security Awareness: familiarity with Microsoft 365 security, including common attack patterns such as business email compromise (BEC) and adversary-in-the-middle (AITM) phishing.
• Third-Party Log Analysis: foundational understanding of log sources across cloud platforms, network devices, identity providers, email platforms, and other enterprise technologies to support investigation and triage within our NG-SIEM service offering.
• Incident Remediation: foundational understanding of targeted attacks and the ability to contribute to tactical and strategic remediation efforts for compromised organizations.
• Network Operations and Architecture/Engineering: strong understanding of secure network architecture and strong background in performing network operations.
• Programming/Scripting: experience or coursework in scripting languages such as Python, PowerShell, or Bash.
• AI Fundamentals: experience or demonstrated interest in utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.
• Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.

Additionally, all candidates must possess the following qualifications:

• Capable of completing technical tasks without supervision.
• Desire to grow and expand both technical and soft skills.
• Strong troubleshooting skills with a passion for solving complex technical problems.
• Ability to foster a positive work environment and attitude.

Requirements:

• Must be willing to work 4x10 schedule, including a day on the weekend.
• Must be willing to work on site (hybrid schedule).

Education:

BA or BS / MA or MS degree in Computer Science, Computer Engineering, Math, Information Security, Information Assurance, Information Security Management, Intelligence Studies, Cybersecurity, Cybersecurity Policy, or a related field. Applicants without a degree but with relevant work experience and/or training will be considered.

Benefits of Working at CrowdStrike:

• Market leader in compensation and equity awards

• Comprehensive physical and mental wellness programs

• Competitive vacation and holidays for recharge

• Paid parental and adoption leaves

• Professional development opportunities for all employees regardless of level or role

• Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections

• Vibrant office culture with world class amenities

• Great Place to Work Certified™ across the globe

CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program.

CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions--including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs--on valid job requirements.

If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at further assistance.

Find out more about your rights as an applicant.

CrowdStrike participates in the E-Verify program.

Notice of E-Verify Participation

Right to Work

For detailed information about the U.S. benefits package, please click here.

Originally posted on Himalayas

Remote SOC Analyst needs 2+ years of experience in a SOC or cybersecurity operations role.

SOC Analyst requires:

• Security certifications such as Security+, CySA+, GCIH, GCIA, or equivalent.
• Experience with scripting (Python, PowerShell) for automation and analysis.
• Exposure to cloud security monitoring (Azure, AWS, GCP).
• Understanding of compliance frameworks (e.g., NIST, ISO 27001, PCI-DSS).
• Experience with Microsoft Sentinel for SIEM and Microsoft Defender for Endpoint for EDR.
• Solid understanding of TCP/IP, Windows/Linux OS internals, and common attack vectors.
• Familiarity with MITRE ATT&CK, cyber kill chain, and threat modeling.

SOC Analyst duties:

• Alert Triage & Validation: Investigate and validate alerts escalated from our security partners using SIEM, EDR, and other security tools.
• Incident Response: Execute containment and remediation steps for confirmed incidents. Escalate to Tier 3 when deeper forensic or threat hunting expertise is required.
• Threat Analysis: Correlate data across multiple sources (network, endpoint, cloud) to identify patterns and indicators of compromise (IOCs).
• Detection Tuning: Work with engineering and Tier 3 teams to fine-tune detection rules and reduce false positives.
• Process Development: Document SOC workflows, procedures, and incident handling processes. Build and maintain runbooks to standardize response actions and improve operational efficiency.
• Continuous Improvement: Stay current on emerging threats, vulnerabilities, and security technologies. Recommend improvements to detection and response capabilities.

Originally posted on Himalayas

ASRC Federal is a leading government contractor furthering missions in space, public health and defense. As an Alaska Native owned corporation, our work helps secure an enduring future for our shareholders. Join our team and discover why we are a top veteran employer and Certified Great Place to Work™

SOC Analyst Location: Remote | Night and Weekend Shifts Required Active Secret Clearance Required

ASRC Federal is seeking a SOC Analyst to support the Department of Defense Education Activity (DoWEA) Enterprise Cyber Program. This role supports enterprise cybersecurity operations, including Risk Management Framework (RMF) compliance, vulnerability management, security monitoring, and incident response, in collaboration with other cybersecurity personnel. This is a remote position requiring scheduled night and weekend shifts in support of SOC operations.

Key Responsibilities:

• Monitor and analyze network traffic, system logs, and other security data for signs of malicious activity.
• Use Security Information and Event Management (SIEM) tools to investigate security alerts and notable events.
• Manage incidents throughout their lifecycle, including analysis, triage, containment, and remediation.
• Recommend improvements to prevent future incidents and expedite response based on lessons learned.
• Communicate effectively and promptly with technical and nontechnical stakeholders.
• Prepare situational awareness reports for the customer and management.
• Develop and maintain manual and automated incident response playbooks.
• Support the development of SIEM detection and data ingestion strategies to improve SOC visibility.
• Conduct host and log forensic analysis and malware analysis as needed.
• Perform threat hunting based on emerging adversary tactics, techniques, and procedures.
• Develop and implement security procedures to prevent future incidents.
• Provide technical support to other members of the security team.
• Stay current on cybersecurity threats and trends.

Required Skills, Certifications, and Qualifications:

• Minimum of five years of relevant cybersecurity experience, including SOC operations, security monitoring, and incident response.
• Must hold and maintain an active Security+ Certification.
• Experience with SIEM tools, such as Microsoft Sentinel.
• Experience leading and managing SOC operations.
• Expertise in analyzing network packets, SIEM alerts, and server and application logs to investigate anomalous or malicious activity.
• Experience tracking incidents using frameworks such as MITRE ATT&CK or the Cyber Kill Chain.
• Ability to analyze advanced persistent threats and map the threat lifecycle.
• Ability to work scheduled night and weekend shifts remotely.
• Active Secret security clearance.

Desired Skills:

• Experience with Microsoft Sentinel.
• Forensic investigation and malware analysis experience.
• Strong curiosity and problem-solving skills.
• Proactive approach and a strong sense of ownership.

We invest in the lives of our employees, both in and out of the workplace, by providing competitive pay and benefits packages. Benefits offered may include health care, dental, vision, life insurance; 401(k); education assistance; paid time off including PTO, holidays, and any other paid leave required by law. The salary offered will depend on several factors including, but not limited to, relevant experience, skills, education, geographic location, internal equity, business needs, and other factors permitted by law. Posted pay ranges are a general guideline only and are not a guarantee of compensation or salary.

EEO Statement ASRC Federal and its Subsidiaries are Equal Opportunity employers. All qualified applicants will receive consideration for employment without regard to race, gender, color, age, sexual orientation, gender identification, national origin, religion, marital status, ancestry, citizenship, disability, protected veteran status, or any other factor prohibited by applicable law.

Originally posted on Himalayas

Originally posted on Himalayas

Since 2004, OSIbeyond has delivered managed technology and cybersecurity services on a founding principle: outstanding technical expertise, matched by an exceptional customer experience. Today, that commitment is delivered through OSIbeyond ONE, our integrated technology platform that unifies IT operations, cybersecurity, Microsoft 365, cloud, automation, AI, and expert support into a single, continuously managed environment. The platform is built on a clear operating philosophy: Automation First. AI Enabled. People Powered.

The OSIbeyond Security Operations Center is the cybersecurity engine of that platform. It provides continuous detection, investigation, and response across a diverse portfolio of client environments, including organizations subject to federal compliance frameworks such as CMMC and NIST SP 800-171. The SOC operates on a two-shift, automation-augmented coverage model. Human analysts staff the Day and Evening shifts, and a purpose-built automation layer operates overnight, backed by an on-call analyst, ensuring that every hour of every day is covered by a trained analyst or by an automated response workflow.

The SOC Analyst is the “People Powered” element of security operations. Automation handles the repetitive, high-volume work of enrichment, correlation, and first-response containment, so that the analyst’s time is concentrated on the work that requires human judgment: validating and investigating alerts, leading incident response, advising clients, and continuously improving detection and automation logic. The SOC engineering team is continuously expanding this automation capability, and analysts are expected to contribute to that evolution as active participants rather than passive users.

This position is suited to a technically accomplished security professional who values structure, precision, and accountability. The successful candidate demonstrates sound analytical judgment, disciplined documentation, professionalism in client communication, and a commitment to protecting client environments with the same care they would expect for their own.

ABOUT THE ROLE:

The SOC Analyst monitors, analyzes, and responds to cybersecurity threats across client environments. The analyst operates the SOC’s security tooling, investigates suspicious activity, contains and remediates confirmed incidents, and communicates findings clearly to clients and internal stakeholders.

During each shift the analyst owns the live alert queue, triaging detections from the SIEM, endpoint, identity, and email security platforms; determining scope and severity; and executing or authorizing the appropriate response. Because the SOC operates on a shift model, the analyst is also responsible for the integrity of coverage: conducting structured handoffs at the end of each shift, reviewing existing alerts at the start of the Day shift, and ensuring that no detection, investigation, or client commitment is left without a clear owner.

Beyond day-to-day operations, the analyst performs scheduled vulnerability scanning, conducts root cause analysis for security incidents, and identifies repetitive manual work that should be transitioned to automation. Performance is measured against response times, investigation quality, SLA adherence, documentation standards, and contributions to the continuous improvement of detection and automation.

SCHEDULE & SHIFT MODEL:

The SOC operates a two-shift model with 12-hour shifts. Each analyst is assigned to a fixed shift (Day or Evening) and does not rotate between shift times. The two shifts overlap for six hours (11:00 AM to 5:00 PM), providing a structured handoff window and dual-analyst coverage during peak business hours. Overnight coverage (11:00 PM to 5:00 AM) is provided by the SOC’s Tines automation layer, which performs enrichment, containment, and escalation according to documented playbooks. Escalations that exceed the automation’s authority are routed to the on-call SOC Analyst.

ESSENTIAL DUTIES & RESPONSIBILITIES:

Security Monitoring & Alert Triage (≈50%)

• Monitor client environments continuously for security threats using the SIEM, endpoint detection and response, identity protection, and email security platforms
• Triage inbound alerts by following the automated priority procedure; determine whether each detection represents a true positive, benign activity, or a tuning opportunity
• Respond to alerts where automation is unable to clearly determine legitimacy and/or severity. Work and complete assigned tickets in accordance with documented standard operating procedures and service level commitments
• Identify recurring false positives and submit detection-tuning recommendations to the SOC Manager and automation team

Incident Investigation & Response (≈25%)

• Investigate security incidents including account compromise, business email compromise, social engineering, malware, and ransomware activity
• Through automated means and manual review, analyze servers, workstations, identities, and other assets suspected of compromise and accurately assess the scope and type of the issue
• Contain and remediate confirmed threats using approved automation workflows, scripts, policies, playbooks, and platform controls; escalate in accordance with the incident response plan when the situation exceeds the analyst’s authority or expertise
• Provide accurate, timely, and professionally written incident communications to designated client points of contact and internal stakeholders with the assistance of the SOC Manager or CISO

Vulnerability Management & Security Posture (≈10%)

• Perform regularly scheduled vulnerability scanning across client environmentsSupport client compliance objectives, including CMMC and NIST SP 800-171 requirements, by producing the monitoring evidence, logs, and reports required by those frameworks
• Contribute to periodic client security reviews with clear, data-supported observations

Automation Oversight & Continuous Improvement (≈15%)

• Review the overnight Tines automation log at the start of the Day shift, confirm low confidence actions were appropriate, and remediate or escalate any exceptions
• While on call, respond to overnight escalations from the automation layer, take ownership of the incident, and document all actions taken for review at the start of the Day shift
• Identify repetitive manual investigation and response steps and submit them to the automation team as candidates for new automations or expanded playbooks
• Identify repetitive “false positives” for the SOC Manager to address
• Test and provide structured feedback on new detections and automation workflows before they are placed into production
• Track and document all work in the ticketing system with detail sufficient for a peer to resume the work without additional context

General Responsibilities

• Provide high-quality written and verbal customer service in every client interaction
• Meet all key performance indicators and notify the SOC Manager promptly when workload or circumstances place a KPI at risk
• Recognize when an assignment should be escalated and escalate without delay
• Support peers across both shifts and contribute to a collaborative, accountable team culture
• Perform other duties as assigned

SUCCESS METRICS:

• Mean time to acknowledge and mean time to respond for alerts during the assigned shift
• Mean time to contain and mean time to resolve for confirmed incidents
• KPI adherence across all assigned tickets
• Escalation accuracy: incidents escalated at the appropriate severity and stage, with complete supporting documentation
• Quality of shift handoffs, measured by open items with a clear owner and no unattended investigations at shift change
• Accuracy of automated-action validation and exceptions correctly identified in the overnight automation review
• On-call responsiveness: acknowledgment and response times for overnight escalations during assigned on-call weeks
• Detection tuning and automation candidates submitted and adopted
• Documentation quality and completeness of ticket notes, incident reports, and root cause analyses
• Client satisfaction with incident communications and security reviews

SECURITY RESPONSIBILITIES:

• Complete training for and maintain awareness of cybersecurity risks, including insider threat, and the appropriate handling of CUI and other regulated data
• Treat client data and OSIbeyond data as sensitive, and do not disclose, release, or otherwise transfer it outside of OSIbeyond or client environments without written permission
• Follow cybersecurity requirements as described in the Employee Handbook and other OSIbeyond policies
• Immediately follow incident response procedures when a security incident or concern is identified
• Assist with the escorting or monitoring of visitors when working onsite
• Monitor alerts from the SIEM and related security platforms, conduct vulnerability scans, and review and update logged events

QUALIFICATIONS:

Experience

• Two or more years of experience in security operations, incident response, or systems administration with a demonstrable security focus; managed service provider experience is strongly preferred
• Demonstrated experience investigating and responding to identity, endpoint, and email-based threats in Microsoft 365 environments

Security Operations Skills

• Working knowledge of SIEM operations, log analysis, and alert triage methodology
• Understanding of common attack techniques and the MITRE ATT&CK framework, and the ability to map observed activity to adversary behavior
• Familiarity with endpoint detection and response, identity protection, and email security controls and their remediation actions
• Ability to perform disciplined, well-documented investigations

Systems & Network Knowledge

• Solid understanding of Microsoft 365 and Entra ID administration, including conditional access, authentication methods, and audit logging
• Working knowledge of Windows server and workstation operating systems, Active Directory, and core networking concepts (TCP/IP, DNS, firewalls, VPN)
• Familiarity with vulnerability scanning platforms and remediation workflows

Automation & Operational Skills

• Comfort operating within an automation-first environment, including validating and troubleshooting the output of automated playbooks (Tines or comparable SOAR tooling)
• Basic scripting or query proficiency (PowerShell, KQL, or similar) sufficient to enrich investigations and validate data
• Disciplined ticket hygiene and documentation habits; ability to write clear, professional client-facing communications
• Reliability and self-management appropriate to a remote, shift-based role with defined coverage responsibilities

Additional Desirable Qualifications

• Experience supporting clients subject to CMMC, NIST SP 800-171, or similar regulatory frameworks
• Prior experience contributing to detection engineering or automation playbook development
• Experience in a 24x7 or shift-based security operations environment

KNOWLEDGE & CERTIFICATIONS

Tooling Environment: SIEM and extended detection and response platforms; Sentinel One and Blumira; Entra ID identity protection; Tines security automation; vulnerability scanning platform; Autotask professional services automation (ticketing); Microsoft Teams for internal collaboration.

Required Certifications (or attainment within the first six months)

CompTIA Security+

CompTIA Network+

Preferred Certifications

CompTIA SecurityX (CASP+) or other DoD 8140 Level II certification

Position:

• Location – Remote from the United States, must be willing to work EST hours
• Shift Schedule: 11:00am-11:00pm EST
• Employment Type - Full time

Benefits:

• Medical Insurance - OSIbeyond pays 75% of the premium for the Employee's base medical plan
• Vision and Dental Insurance - OSIbeyond pays 75% of the premium for the Employee's plans
• Life Insurance - OSIbeyond pays 100% of the premium for the Employee's plans
• Short Term Disability Insurance - OSIbeyond pays 100% of the premium for the Employee's plans
• 401K - OSIbeyond matches up to 4%
• PTO/Holidays - 9 paid Holidays and accrual based PTO which increases with tenure, new hires start out with 2 weeks.

Originally posted on Himalayas