Level 3 SOC Analyst - Senior Security Operations

Hybrid | Broward county FL | 24x7x365 SOC

We are seeking an experienced Level 3 SOC Analyst to serve as a senior technical authority within a 24x7x365 Security Operations Center.

This is a hands-on technical role, not a people-management position. The Level 3 Analyst will own complex investigations escalated by Level 1 and Level 2 analysts, conduct advanced threat hunting and forensic analysis, improve detection quality, and provide technical mentorship and escalation support to the SOC team.

The ideal candidate is an experienced security professional who can independently investigate sophisticated threats, make sound decisions during high-severity incidents, and clearly communicate findings to both technical teams and customers.

Key Responsibilities

Advanced Investigation & Threat Analysis

• Own complex security investigations escalated from Level 1 and Level 2 analysts.
• Determine incident scope, impact, root cause, and disposition.
• Investigate advanced threats including:
• Ransomware and pre-ransomware activity
• Advanced persistent threats (APTs)
• Business Email Compromise (BEC)
• Identity-based attacks
• Insider threats
• Reconstruct attack timelines across endpoint, identity, network, email, and cloud telemetry.
• Perform forensic analysis involving logs, host artifacts, identity activity, memory/disk artifacts, and network traffic.
• Produce technically defensible findings suitable for customers and regulated environments.

Security Technology & Detection Stack

Work across enterprise security technologies including:

• Huntress MDR/EDR/ITDR
• Google Chronicle / Google Sec Ops
• Crowd Strike
• Microsoft Defender
• Microsoft 365
• Microsoft Entra
• SIEM/SOAR technologies
• Threat intelligence platforms
• Endpoint and network telemetry

Comparable experience with platforms such as Microsoft Sentinel or Splunk is also highly relevant.

Incident Response

• Serve as the senior technical escalation point during high-severity security incidents.
• Coordinate response activities with SOC leadership, infrastructure/NOC teams, cybersecurity teams, and external partners.
• Confirm true-positive incidents and identify indicators of compromise.
• Coordinate containment activities with infrastructure teams.
• Support major incident response and incident command.
• Work against defined severity-based response requirements and MTTA, MTTD, and MTTR objectives.
• Identify incidents that may trigger contractual or regulatory notification requirements and escalate appropriately.
• Lead technical post-incident reviews and identify required detection or process improvements.

Threat Hunting & Proactive Defense

• Conduct structured, hypothesis-driven threat hunts across customer environments.
• Search for Indicators of Compromise (IOCs) and Indicators of Attack (IOAs).
• Perform retrospective analysis against historical telemetry.
• Use threat intelligence and MITRE ATT&CK to guide investigations.
• Identify gaps in existing detection coverage.
• Help improve overall threat-detection capabilities.

Detection Engineering & Tuning

• Analyze detection rules, correlation logic, raw logs, and normalized security data.
• Investigate false positives, detection gaps, parser failures, and missing telemetry.
• Develop evidence-based recommendations for detection-rule improvements.
• Work with SIEM/SOAR and detection-engineering teams on:
• Detection tuning
• Parser and schema mapping
• Use-case development
• Detection scoring
• Log ingestion
• Validate that detection changes continue to identify the threats they were designed to detect.
• Identify repetitive investigation, enrichment, triage, and containment processes that can be automated.
• Support the development of security automation and SOAR workflows.

Mentorship & Technical Leadership

• Provide technical guidance and escalation support to Level 1 and Level 2 SOC Analysts.
• Review investigations and case documentation for technical quality.
• Help junior analysts develop stronger investigation and incident-response skills.
• Develop and maintain:
• Incident-response playbooks
• Runbooks
• Standard Operating Procedures (SOPs)
• Support SOC onboarding, tabletop exercises, and incident-response simulations.

This position does not have direct reports. Technical mentorship is a core responsibility.

Customer Communication & Documentation

• Independently produce professional incident reports covering:
• Incident timeline
• Root cause
• Scope and impact
• Actions taken
• Recommended remediation
• Clearly communicate complex security findings to technical and non-technical audiences.
• Participate in customer incident calls when required.
• Maintain accurate investigation…