Lead SOC Analyst

Job Title: Lead Security Analyst Location: Remote Start Date: ASAP Duration: 3 Month Contract-to-Hire Compensation: $70-80/hr Benefits: Eligible for Health, Dental, Vision, 401KJob Description: Our client, a large emergency medical services and transportation organization, is seeking a Lead Security Analyst with a strong SIEM engineering background. This role is heavily focused on the engineering side of the SIEM, including log onboarding and data source integration, rather than day-to-day analyst triage. The ideal candidate deeply understands how the SIEM works under the hood and can investigate logs, tables, and data to quickly identify attackers and attack vectors, while also supporting incident response efforts.Day-to-Day Responsibilities:Own the engineering and onboarding of new log sources and data connections into the SIEM (firewalls, EDR, cloud platforms, identity telemetry)Maintain a deep understanding of how the SIEM works and how the SOC uses it, ensuring log/data health across sourcesAssist with tuning detection logic and alerts, and support automation efforts to enable rapid responseProactively engage technical and non-technical teams to onboard additional logs and maintain log healthInvestigate logs (tables, columns, values) to identify attackers and attack vectors, supporting quick containmentSupport incident response and act as a technically strong partner to the incident commanderDevelop automation and integration scripts to enhance SOC workflowsCommunicate consistently with the team through updates, feedback, and delivery of tangible work productPartner cross-functionally with Infrastructure, Compliance, and Operations teamsAssist with documentation, reporting, runbooks, and SOPsMinimum Requirements:5 years of security operations experience; 7 years of broad IT experienceStrong hands-on SIEM engineering background, especially log onboarding and data source integration (Microsoft Sentinel preferred)Deep understanding of the mechanics of how a SIEM works and how a SOC uses itDeep Microsoft ecosystem expertise, including Azure - considered a critical, non-negotiable component of this roleExperience assisting with detection tuning, alerting, and automation for rapid responseStrong PowerShell scripting skillsKQL (log query language)Outgoing, proactive communicator able to work with both technical and non-technical teamsConsistently engaged team player who provides regular updates and delivers tangible workExperience supporting enterprise environments of 35,000 usersPreferred Qualifications:Bash scriptingPython scriptingExperience with CrowdStrike or other enterprise EDR platformsExperience with Microsoft Copilot for Security or similar AI security toolingFamiliarity with healthcare or regulated environments (HIPAA, PCI)