SOC Tier 1 Analyst

This is a remote position.

The SOC Tier 1 Analyst serves as the first line of cyber defense within the Security Operations Center. This position is responsible for continuously monitoring security tools, reviewing alerts, identifying suspicious activity, and conducting initial investigations of potential security events. The analyst serves as the organization's frontline defender and is often the first person to identify indicators of malicious activity.

The Tier 1 Analyst reviews alerts generated by security technologies including SIEM platforms, EDR solutions, email security systems, network monitoring tools, cloud security platforms, and threat intelligence feeds. The analyst determines whether activity represents a false positive, a policy violation, or a potential security incident requiring escalation.

The position requires disciplined analytical thinking, attention to detail, and the ability to follow established procedures while maintaining awareness of the broader threat landscape. The analyst is responsible for documenting findings, creating incident tickets, collecting initial evidence, and escalating incidents to higher-level analysts when required.

The successful candidate must possess a strong understanding of cybersecurity fundamentals including networking concepts, operating systems, authentication mechanisms, malware behavior, phishing techniques, and common attack methods. The analyst should understand TCP/IP, DNS, HTTP, Active Directory, VPN technologies, and cloud security fundamentals.

The candidate must demonstrate experience using SIEM platforms, security dashboards, log analysis tools, endpoint detection solutions, ticketing systems, and incident management workflows. Strong written communication skills are essential because analysts must document investigations clearly and provide concise incident summaries.

The position requires the ability to work effectively in a 24x7 operational environment while maintaining focus during periods of high alert volume. Candidates should demonstrate curiosity, adaptability, and a willingness to learn new technologies continuously and threat actor techniques.

Typical certifications include Security+, CySA+, GSEC, SSCP, or equivalent cybersecurity certifications.

The candidate must have a minimum of Secrete Clearance.