SOC ANALYST TIER 2/3 (Contractor)

Remote, USA

Posted Jun 14, 2026

Full-time

SOC 2/3 Engineer (Remote Contractor): 
 
General Duties - 
Responsible for investigating security incidents and determining their root causes. They review incidents that have been escalated by Tier 1 analysts, who are responsible for collecting data and reviewing alerts. Tier 2/3 analysts use threat intelligence, such as indicators of compromise, TTPs, and company host system/network data sets to assess the alerts, threats and potential incidents in more depth. 
 
General Skills - 
They have deep experience with SIEM tools specifically Crowdstrike SIEM, network data, host data, Identity and Access log data, developing SIEM use cases, reducing/tuning false alerts and leading investigations until issues have been resolved. They will also monitor systems and events across different operating systems, such as Windows, macOS, and Linux. 
 
Specific Requirements - 
<ul>
<li>Must have 5+ years recent experience as Tier 2 or 3 analyst at a large organization; government and Critical Infrastructure company preferred. </li>
</ul>
<ul>
<li>Must have strong, demonstrated SIEM and data correlation experience </li>
</ul>
<ul>
<li>Must have demonstrated experience designing new SOC use cases and working with vendor on implementing new use cases. </li>
</ul>
<ul>
<li>Must have experience designing and implementing runbooks and use cases to mitigate security incidents </li>
</ul>
<ul>
<li>Experience designing Incident Response plan, including alert definition, runbooks, escalation, etc.. </li>
</ul>
<ul>
<li>Experience documenting incident response communications for technical and management audiences </li>
</ul>
<ul>
<li>Must have extensive experience reviewing and managing alerts in Microsoft Defender, Splunk </li>
</ul>
<ul>
<li>Must have experience conducting hunts across disparate data sets, to include host data, vulnerability data, threat data, network data, active directory data, among others to identify threats </li>
</ul>
<ul>
<li>Experience leading timely security operations response efforts in collaboration with stakeholders </li>
</ul>
<ul>
<li>Must have experience setting up alert rules and effective alert management </li>
</ul>
<ul>
<li>Demonstrated ability to create runbooks and conducting investigations with key application, IT Infra and other stakeholders </li>
</ul>
<ul>
<li>Experience designing custom SOC SIEM use cases in Defender, Splunk and CRWD </li>
</ul>
<ul>
<li>Experience conducting forensic work investigations </li>
</ul>
<ul>
<li>Strong security operations documentation abilities </li>
</ul>
 
Attributes sought - 
<ul>
<li>Must be proactive, problem solver and curious. </li>
</ul>
<ul>
<li>Most be a problem solver </li>
</ul>
<ul>
<li>Must be curious </li>
</ul>
<ul>
<li>Must be analytical, qualitative and quantitative abilities </li>
</ul>
<ul>
<li>Must be adaptive to dynamic environment </li>
</ul>
 
 
**MST or PST shift times**

Apply Now

SOC ANALYST TIER 2/3 (Contractor)

More Remote Jobs