Remote SOC Investigation Specialist Talent Network - AI Trainer

Mercor is hiring a SOC Investigation Specialist on behalf of high‑growth technology and enterprise partners building next‑generation SOC automation and AI‑driven investigation systems. This role is ideal for experienced SOC analysts who can apply real‑world investigative judgment to review, validate and construct high‑quality security investigations across SIEM, endpoint, cloud, and identity environments.

• Review, monitor, and evaluate SOC alerts and investigation outputs based on predefined scenarios and criteria.
• Distinguish true positives from false positives by validating investigative evidence and alert context.
• Perform end‑to‑end security investigations when required, including log analysis, entity pivoting, timeline reconstruction and evidence correlation.
• Assess the correctness, completeness and quality of SOC investigations produced by automated or human workflows.
• Apply consistent investigative judgment while recognizing that multiple valid investigation paths may exist for the same alert.
• Make clear binary determinations (e.g., ACCEPT / PASS) while also producing detailed ground‑truth investigations when required.
• Use Splunk extensively to pivot across logs, entities and timelines, including reading and reasoning about SPL queries.
• Maintain clear and accurate documentation of investigative steps, assumptions, evidence and conclusions.
• Collaborate with program leads and other expert annotators to uphold high‑quality investigation and annotation standards.
• Mentor or support other analysts where applicable, particularly in long‑term or lead annotator roles.

• 3+ years of hands‑on experience as a SOC analyst in a production SOC environment (Tier 2 or above strongly preferred).
• Strong understanding of alert triage, incident investigation workflows and evidence‑based decision‑making under time constraints.
• Mandatory hands‑on experience with Splunk, including:
  • Conducting investigations using Splunk
  • Reading, understanding and reasoning about SPL queries
  • Pivoting between logs, entities and timelines
• Proven ability to evaluate SOC investigations and determine whether conclusions are valid, incomplete or incorrect.
• Strong investigative judgment and comfort making decisive evaluations.
• Fluent English (written and spoken) with strong documentation and communication skills.

• Experience with Endpoint Detection & Response (EDR) tools such as Crowd Strike Falcon, Microsoft Defender for Endpoint, or Sentinel One.
• Experience analysing cloud security logs and signals:
  • AWS (Cloud Trail, Guard Duty)
  • Azure (Activity Log, Defender for Cloud)
  • GCP (Cloud Audit Logs)
• Familiarity with Identity & Access Management platforms such as Okta Identity Cloud or Microsoft Entra  (Azure AD).
• Experience with email security tools like Proofpoint or Mimecast.
• SOC leadership or mentoring experience.
• Basic scripting experience (Python or similar).
• Security certifications (optional): GCIA, GCIH, GCED, Splunk certifications, Security+, CCNA or cloud security certifications.

• Work on cutting‑edge SOC automation and AI‑driven investigation systems.
• Apply real‑world SOC expertise to shape how future security teams investigate and respond to threats.
• Take ownership of high‑impact investigative evaluations and ground‑truth security cases.
• Collaborate with experienced SOC practitioners, security engineers and AI teams.
• Join Mercor’s global network of vetted security professionals.