Security Operations Center Analyst

Monitor, triage, and investigate security events across AWS, endpoint security platforms, Google Workspace, identity providers, and other enterprise security solutions.

Review and analyze threat intelligence feeds, Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) to validate detections, improve monitoring, and enhance detection use cases.

Enrich security investigations using OSINT, domain intelligence, and threat intelligence sources to identify malicious activity and support attribution.

Correlate telemetry from endpoints, networks, cloud environments, identity platforms, SIEM, EDR, and other security tools to build comprehensive investigation context and identify threats.

Design, develop, maintain, and optimize SIEM/SOAR detection rules, playbooks, dashboards, and alerts. Onboard and validate new log sources to ensure complete and normalized visibility.

Perform proactive threat hunting and endpoint/cloud forensics to identify previously undetected threats, determine scope and root cause, and provide evidence to support incident response.

Lead end-to-end incident response activities, including triage, investigation, containment, eradication, recovery, root cause analysis (RCA), reporting, and maintenance of incident response playbooks and standard operating procedures.

Monitor and recommend security improvements across AWS services, including CloudTrail, GuardDuty, Security Hub, IAM, VPC Flow Logs, CloudWatch, and AWS Config, to detect suspicious activity and misconfigurations.

Investigate identity-related threats using authentication logs, privileged account activity, and collaboration platform audit logs.

Administer, integrate, and perform health checks for SIEM, SOAR, EDR, and related security technologies to ensure reliable security operations.

Develop and maintain security automation, internal tools, and integrations using Python, PowerShell, Bash, APIs, and webhooks to improve investigation and response efficiency.

Maintain and optimize threat intelligence repositories, IOC watchlists, enrichment workflows, and dashboards, translating intelligence into improved detections and alert tuning.