W2 Only (No C2C) :: Remote :: Senior SOC Analyst (L3) Exp. with Palo Alto, Cortex, Fortinet, Tenable, Rapid7, Cribl, EDR/XDR & Active Certifications - Night Shift || G.C / U.S.C

Role Summary

Senior-level SOC Analyst responsible for complex incident detection, investigation, and response across endpoint, network, identity, and cloud.

Acts as the primary escalation point for Tier 1/2, drives threat hunting and detection engineering, and mentors the broader SOC team.

Work Schedule

Shift: 6:00 PM–6:00 AM local time

Model: Hybrid with rotating nights, weekends, and holidays (24x7x365 coverage)

Core Responsibilities

• Lead triage and investigation of high-severity/complex security incidents; coordinate containment, eradication, and recovery activities.
• Serve as L3 escalation for Tier 1/2; provide technical guidance and approve incident closures/escalations.
• Conduct proactive threat hunting across EDR/XDR, network, identity, and cloud telemetry leveraging MITRE ATT&CK.
• Develop, tune, and validate detections and correlation logic in SIEM/XSIAM; reduce false positives and improve detection fidelity.
• Perform root-cause analysis and create actionable remediation plans with cross-functional teams.
• Build and maintain response playbooks, SOPs, and knowledge base articles; contribute to training and mentoring pathways.
• Support backup/recovery validation and backend SOC tooling troubleshooting as needed.
• Produce clear incident documentation, executive-ready summaries, and technical recommendations.

Required Qualifications

• 5–8 years of hands-on SOC or Cybersecurity operations experience, including advanced incident response and security monitoring.
• Demonstrated expertise with SIEM/XSIAM, EDR/XDR, and SOAR workflows; strong analytical and investigative skills.
• Proven experience performing threat hunting, detection engineering/tuning, incident escalation, and root-cause analysis.
• Familiarity with MITRE ATT&CK and NIST-aligned processes and playbooks.
• Strong communication skills for cross-functional coordination and mentoring.
• Willingness to work night shifts in a rotating 24x7 environment.

Preferred Qualifications

• Practical experience with: Palo Alto (including Cortex), Fortinet, Tenable, Rapid7, Cribl, and major EDR/XDR platforms.
• Broader knowledge across network, identity, and cloud security controls and telemetry.
• Scripting/automation for detection and response (e.g., Python, PowerShell) and query languages (e.g., KQL, SPL, SQL, regex).

Certifications

• Active, relevant certifications strongly preferred: GIAC (e.g., GCIH, GCIA, GCFE, GCDA), CISSP, or equivalent.

Tools and Platforms

• SIEM/XSIAM, SOAR, EDR/XDR
• Palo Alto, Cortex, Fortinet
• Tenable, Rapid7
• Cribl and related log/telemetry pipelines

Deliverables and Success Criteria

• Complete incident investigation reports with validated containment/eradication steps and RCA.
• Measurable improvements to detection content and response playbooks (e.g., reduced false positives, improved MTTD/MTTR).
• Published knowledge articles, SOPs, and training materials for SOC staff.
• Documented escalations and technical guidance to partner teams.
• Contributions to SOC process optimization and monitoring coverage enhancements.
• Final deliverables and acceptance criteria to be confirmed with the engagement team.