Our client, a Communications company, is looking for a SOC Analyst for their Herndon, VA location.
Responsibilities:
Work in a fast-paced, SLA-driven Security Operations Center (SOC), using tools such as Splunk (SIEM) and ServiceNow to help identify and manage security incidents.
This position is ideal for individuals looking to build a strong foundation in cybersecurity operations within a structured and process-driven environment, with opportunities for growth and skill development.
Monitor security events and alerts using Splunk SIEM to identify suspicious activity across network, endpoint, and cloud environments.
Perform initial triage and investigation of alerts, following defined procedures to determine severity and required actions.
Respond to security incidents in accordance with established SLAs, ensuring timely escalation and proper handling.
Use ServiceNow to log, track, and document incidents, maintaining accurate records throughout the lifecycle.
Conduct basic threat research to stay informed on emerging threats, vulnerabilities, and attacker techniques.
Support incident analysis by identifying contributing factors and assisting with remediation recommendations.
Collaborate with security engineering, and threat hunting to resolve incidents and strengthen security controls.
Follow and contribute to standard operating procedures (SOPs) and playbooks to ensure consistent incident response.
Communicate clearly with internal stakeholders regarding incident status and actions taken.
Support day-to-day operational activities within the team
Perform technical and operational tasks aligned with business needs
Work may involve hands-on operational support, troubleshooting, and maintenance-type responsibilities (inferred based on role title)
Requirements:
Seeking a motivated and detail-oriented SOC Analyst Level I to join our cybersecurity operations team. In this role, you will support continuous monitoring, detection, and initial response to security events across enterprise environments.
Bachelor’s degree in Cybersecurity, Information Technology, or a related field (or equivalent experience)
Proficient understanding of SOC operations and the incident response lifecycle
Familiarity with SIEM tool Splunk.
Exposure to ServiceNow or similar ticketing systems
Knowledge of networking fundamentals, security principles, and log analysis
Strong analytical and problem-solving skills
Ability to work in a 24x7 operational environment with strict SLA requirements
Familiarity with threat intelligence concepts or frameworks such as MITRE ATT&CK
2+ years of hands-on experience in security monitoring or incident response environments
Candidates should be able to operate independently and contribute to ongoing operations
Hands-on operational/technical environment involving troubleshooting, maintenance, and use of internal systems/tools in a structured, process-driven setting. Likely includes infrastructure/network-related support
Team-oriented, fast-paced operational environment focused on safety, reliability, and collaboration, with a mix of independent work and team support
A typical day includes reviewing work orders, performing hands-on troubleshooting and maintenance, monitoring systems, responding to issues, and documenting work while collaborating with the team
Ramp-up includes onboarding and training in the first 1–2 weeks, with increasing independence over the first 30 days and full productivity expected within 30–60 days
Must-Have Tools
Splunk (Required):
Hands-on experience with Splunk SIEM is mandatory; ~90% of the work will be performed within Splunk
Candidates should have practical experience and/or Splunk certification