SOC Investigation Analyst

About the Role: SOC Investigation Analyst

Crossing Hurdles is seeking a highly skilled SOC Investigation Analyst to join its Talent Network. This remote position offers flexible commitment of 10–40 hours/week, focusing on critical security operations and incident response.

Role Responsibilities

• Review, monitor, and evaluate SOC alerts and investigation outputs based on predefined scenarios and criteria.
• Distinguish true positives from false positives by validating investigative evidence and alert context.
• Perform end-to-end security investigations including log analysis, entity pivoting, timeline reconstruction, and evidence correlation.
• Assess the correctness, completeness, and quality of SOC investigations produced by automated or human workflows.
• Apply consistent investigative judgment and recognize multiple valid investigation paths.
• Make binary determinations while producing detailed ground-truth investigations when required.
• Use Splunk to pivot across logs, entities, and timelines and reason about SPL queries.
• Maintain clear and accurate documentation of investigative steps, assumptions, evidence, and conclusions.
• Collaborate with program leads and other expert annotators to uphold investigation and annotation standards.
• Mentor or support other analysts where applicable.

Requirements

• Hands-on experience as a SOC analyst in a production SOC environment.
• Strong understanding of alert triage, incident investigation workflows, and evidence-based decision-making.
• Hands-on experience with Splunk including conducting investigations and reasoning about SPL queries.
• Ability to pivot between logs, entities, and timelines.
• Proven ability to evaluate SOC investigations and determine validity of conclusions.
• Strong investigative judgment and ability to make decisive evaluations.
• Fluent English with strong documentation and communication skills.
• Experience with Endpoint Detection & Response (EDR) tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne.
• Experience analyzing cloud security logs such as AWS, Azure, or GCP.
• Familiarity with Identity & Access Management (IAM) platforms such as Okta or Microsoft Entra ID.
• Experience with email security tools like Proofpoint or Mimecast.
• SOC leadership or mentoring experience.
• Basic scripting experience (Python or similar).
• Security certifications such as GCIA, GCIH, GCED, Splunk certifications, Security+, CCNA, or cloud security certifications.

Application Process

The application process for the SOC Investigation Analyst role is streamlined and efficient, taking approximately 20 minutes:

• Upload resume
• Interview (15 min)
• Submit form

Key skills/competency

• SOC analysis
• Splunk
• Incident investigation
• Log analysis
• Endpoint Detection & Response (EDR)
• Cloud security
• Identity & Access Management (IAM)
• Security certifications
• Scripting (Python)
• Threat detection