SOC Analyst
Remote SOC Analyst (placed via WOW Remote Teams) for an established U.S. law firm: investigates and owns security alerts escalated by an MSSP from detection through resolution, and hardens Microsoft 365 and endpoint defenses using tools like Microsoft Defender, Microsoft Sentinel, and SentinelOne. Requires 2–4 years in security operations and Eastern Time working hours.
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Remote
- Seniority
- Middle
- Employment
- Full time
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- 2–4 years of professional experience in cybersecurity, security operations, SOC environments, or incident response
- Hands-on experience with at least one of: Microsoft Defender, Microsoft Sentinel, or SentinelOne
- Practical knowledge of endpoint detection and response (EDR) technologies
- Experience investigating security alerts, identifying malicious activity, and responding to security incidents
- Ability to manage security tickets independently from initial detection through final resolution
- Knowledge of Microsoft 365 security configurations, threat protection, and security best practices
- Experience implementing remediation actions and verifying successful incident resolution
- Strong understanding of security monitoring, threat detection, and incident response workflows
- Ability to evaluate security risks and recommend appropriate corrective actions
- Strong analytical, troubleshooting, and problem-solving capabilities
- Ability to prioritize security incidents and work independently with minimal supervision
- Strong communication skills for technical and nontechnical stakeholders
- Advanced English proficiency for communication with a U.S.-based team
- Availability to work during Eastern Time business hours
Nice to have
- Educational background or equivalent practical experience in Cybersecurity, IT, Computer Science, Information Security, or related field
- Experience collaborating with Managed Security Service Providers (MSSPs)
- Familiarity with SIEM platforms and security alert correlation
- Knowledge of cybersecurity policies, security hardening, and risk mitigation
- Experience handling sensitive or confidential information in security operations
- Familiarity with security frameworks such as NIST or CIS Controls
- Knowledge of identity and access management within Microsoft environments
- Certifications such as Microsoft SC-200 or CompTIA Security+
Full description
This is a remote position.
Our client is looking for a SOC Analyst to join their IT department and oversee security operations across their endpoints, cloud systems, and identity infrastructure. They are a prominent full-service legal practice that has recently been recognized among the top employers in their region for workplace excellence and continued organizational growth. Reporting to the IT Director, this hands-on operator will serve as the central point of contact for cybersecurity, collaborating closely with a Managed Security Service Provider (MSSP) and internal IT personnel to validate alerts, contain threats, drive tickets to closure, and strengthen security policies and controls.
Responsibilities
- Monitor, triage, and respond to security alerts generated by the MSSP, XDR platforms (including SentinelOne and Windows Defender), and additional security tools across endpoints, identity, and cloud systems.
- Quickly validate security detections by distinguishing between false positives and true positives, assessing the scope of impact, and thoroughly documenting all supporting evidence.
- Take full end-to-end ownership of security tickets by categorizing, prioritizing, escalating as needed, and driving issues to complete closure with clear timelines and detailed notes.
- Coordinate threat containment measures with the internal IT team—such as isolating endpoints, executing account actions, and blocking malicious indicators—in alignment with established incident response procedures and severity guidelines.
- Strengthen security configurations within Microsoft 365 and endpoint detection and response (EDR) environments.
- Analyze trends across alerts and security incidents to recommend and implement approved policy and control adjustments that mitigate risk and reduce recurring alert noise, including tuning detection logic, tightening access controls, and updating security standards.
- Maintain, refine, and update SOC playbooks and incident response documentation as new threat patterns emerge.
- Prepare concise, decision-ready weekly and monthly security reports for the IT Director covering incident summaries (events, impact, and remediation), alert volumes and categories, response times, closure quality, control gaps, and recommended fixes.
- Support ongoing continuous improvement initiatives focused on endpoint telemetry, security monitoring, and incident response workflows.
Requirements
Requirements
- 2+ years of hands-on professional experience in a SOC analyst, security monitoring, or incident response role.
- Demonstrated experience triaging security alerts and managing tickets from initial detection through final resolution rather than solely monitoring dashboards.