Sr. Analyst, SOC
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need headings for sections present.
We have: Summary (Description). Could treat as "About the role". We'll put About the role
then
with summary text. Responsibilities: list bullet points. Use
- .
Requirements: list bullet points.
Required Skills: list bullet points.
Preferred Skills: list bullet points.
Benefits: paragraph.
We should not include Pay/Schedule because not present.
We must not repeat job title as heading.
We must not include metadata like End Date, # of Openings, Position Type, Locations, Additional Details. Those are minor metadata; we can fold into a short
or drop. Probably drop them. We must preserve all substantive information: summary, responsibilities, requirements, required skills, preferred skills, benefits. We must not invent or summarize away detail. We must not include boilerplate. We must output only HTML fragment. Let's extract text. Title: Sr. Analyst, SOC End Date: # of Openings: 1 Position Type: Contract to Hire Locations: Louisville, Additional Details: 6 months CTH Visa Independent Candidates Only 100% Remote Description: Summary: We are seeking a Senior Security Analyst to strengthen and mature Security Operations (SOC) detection and response capabilities across enterprise, cloud, and third-party environments. This role is accountable for advanced alert triage, investigation, and incident analysis. The Senior Security Analyst partners closely with the incident response team, IT, and engineering teams to improve signal quality, close detection gaps, and strengthen operational readiness. The ideal candidate is a senior individual contributor with strong investigation skills, excellent judgment under pressure, and the ability to translate attacker behavior and telemetry into actionable response and detection improvements. Responsibilities: Performing threat-informed analysis of alerts and events, validating severity, scope, and business impactApplying threat intelligence and adversary tradecraft to prioritize, contextualize, and enrich investigationsIdentifying patterns of attacker behavior and emerging threats; translating findings into detection and response improvementsConducting advanced alert triage, investigation, and escalation across endpoint, network, identity, SaaS, and cloud telemetryInvestigating identity, access, and configuration-related alerts (e.g., anomalous sign-ins, privilege changes, suspicious OAuth/app consent, policy changes)Supporting incident investigation and response activities, including containment recommendations and responder handoffsCollecting, preserving, and analyzing evidence; producing clear documentation suitable for incident reviews and potential legal/compliance needsTuning detections and improving signal quality by reducing false positives, improving fidelity, and expanding meaningful coverageAnalyzing detection gaps and control weaknesses surfaced through investigations; partnering with control owners to drive remediationValidating detection effectiveness through testing, simulation, and structured attack emulation; documenting outcomes and follow-upsContributing to post-incident reviews, lessons learned, and playbook/runbook updatesDriving continuous improvement of SOC processes, metrics, and operational readiness; mentoring other analysts as needed Requirements: 6 years in security operations, incident response, or threat detection, with demonstrated ownership of complex investigationsStrong experience triaging and investigating alerts across SIEM, EDR/XDR, identity platforms, and cloud/SaaS environmentsProficiency with investigation workflows: hypothesis-driven analysis, scoping, timeline creation, and clear escalation/handoffHands-on ability to query and analyze telemetry and turn findings into actionable outcomesPractical knowledge of attacker techniques and common enterprise attack paths (identity compromise, lateral movement, persistence, exfiltration)Experience applying threat intelligence (IOCs/TTPs) to investigations and to improve detection contentStrong written and verbal communication skills, including producing incident documentation appropriate for technical and leadership audiencesAbility to influence and collaborate across teams (IT, cloud, infrastructure, engineering) and mentor junior members Required Skills: Detection and hunting experienceCloud security operations experience in GCP, including investigation of cloud control plane and SaaS audit logsHands-on incident response experience (on-call/rotations), including coordination, containment support, and recovery validationScripting/automation skills to enrich investigations and improve SOC efficiency Preferred Skills: Leading complex investigations from initial alert through containment recommendations, escalation, and handoffCorrelating endpoint, network, identity, cloud, and SaaS telemetry to validate attacker behavior and determine scopeEnriching cases with threat intelligence and internal context to prioritize response and reduce time-to-decisionTuning detections and building investigation queries to improve fidelity and reduce repeat noisePartnering with MSSP and internal incident response team members, IT, and engineering teams to close gaps discovered during investigationsRunning targeted threat hunts and validation exercises to confirm detection coverage and document resultsUpdating playbooks/runbooks and coaching other analysts on investigation quality, documentation, and escalation standards Benefits: This role offers hands-on security operations work focused on advanced investigations, incident analysis, and continuous improvement of detection and response across the environment. We need to split bullet points correctly. The responsibilities list is a run-on sentence separated by no punctuation? Actually each item separated by no conjunction? Let's parse: "Performing threat-informed analysis of alerts and events, validating severity, scope, and business impactApplying threat intelligence and adversary tradecraft to prioritize, contextualize, and enrich investigationsIdentifying patterns of attacker behavior and emerging threats; translating findings into detection and response improvementsConducting advanced alert triage, investigation, and escalation across endpoint, network, identity, SaaS, and cloud telemetryInvestigating identity, access, and configuration-related alerts (e.g., anomalous sign-ins, privilege changes, suspicious OAuth/app consent, policy changes)Supporting incident investigation and response activities, including containment recommendations and responder handoffsCollecting, preserving, and analyzing evidence; producing clear documentation suitable for incident reviews and potential legal/compliance needsTuning detections and improving signal quality by reducing false positives, improving fidelity, and expanding meaningful coverageAnalyzing detection gaps and control weaknesses surfaced through investigations; partnering with control owners to drive remediationValidating detection effectiveness through testing, simulation, and structured attack emulation; documenting outcomes and follow-upsContributing to post-incident reviews, lessons learned, and playbook/runbook updatesDriving continuous improvement of SOC processes, metrics, and operational readiness; mentoring other analysts as needed" We need to split at each capitalized verb? Could separate by looking for capital letters after a period? There are no periods. We'll need to infer items. Probably each item starts with a gerund verb: Performing..., Applying..., Identifying..., Conducting..., Investigating..., Supporting..., Collecting..., Tuning..., Analyzing..., Validating..., Contributing..., Driving... Thus we can split before each capitalized word that starts a gerund? Let's manually list: 1. Performing threat-informed analysis of alerts and events, validating severity, scope, and business impact 2. Applying threat intelligence and adversary tradecraft to prioritize, contextualize, and enrich investigations 3. Identifying patterns of attacker behavior and emerging threats; translating findings into detection and response improvements 4. Conducting advanced alert triage, investigation, and escalation across endpoint, network, identity, SaaS, and cloud telemetry 5. Investigating identity, access, and configuration-related alerts (e.g., anomalous sign-ins, privilege changes, suspicious OAuth/app consent, policy changes) 6. Supporting incident investigation and response activities, including containment recommendations and responder handoffs 7. Collecting, preserving, and analyzing evidence; producing clear documentation suitable for incident reviews and potential legal/compliance needs 8. Tuning detections and improving signal quality by reducing false positives, improving fidelity, and expanding meaningful coverage 9. Analyzing detection gaps and control weaknesses surfaced through investigations; partnering with control owners to drive remediation 10. Validating detection effectiveness through testing, simulation, and structured attack emulation; documenting outcomes and follow-ups 11. Contributing to post-incident reviews, lessons learned, and playbook/runbook updates 12. Driving continuous improvement of SOC processes, metrics, and operational readiness; mentoring other analysts as needed Now Requirements: similar run-on. Items start with capitalized words: 6 years..., Strong experience..., Proficiency..., Hands-on ability..., Practical knowledge..., Experience applying..., Strong written..., Ability to influence... Let's split: 1. 6 years in security operations, incident response, or threat detection, with demonstrated ownership of complex investigations 2. Strong experience triaging and investigating alerts across SIEM, EDR/XDR, identity platforms, and cloud/SaaS environments 3. Proficiency with investigation workflows: hypothesis-driven analysis, scoping, timeline creation, and clear escalation/handoff 4. Hands-on ability to query and analyze telemetry and turn findings into actionable outcomes 5. Practical knowledge of attacker techniques and common enterprise attack paths (identity compromise, lateral movement, persistence, exfiltration) 6. Experience applying threat intelligence (IOCs/TTPs) to investigations and to improve detection content 7. Strong written and verbal communication skills, including producing incident documentation appropriate for technical and leadership audiences 8. Ability to influence and collaborate across teams (IT, cloud, infrastructure, engineering) and mentor junior members Required Skills: items: Detection and hunting experience; Cloud security operations experience in GCP, including investigation of cloud control plane and SaaS audit logs; Hands-on incident response experience (on-call/rotations), including coordination, containment support, and recovery validation; Scripting/automation skills to enrich investigations and improve SOC efficiency Preferred Skills: items: Leading complex investigations from initial alert through containment recommendations, escalation, and handoff; Correlating endpoint, network, identity, cloud, and SaaS telemetry to validate attacker behavior and determine scope; Enriching cases with threat intelligence and internal context to prioritize response and reduce time-to-decision; Tuning detections and building investigation queries to improve fidelity and reduce repeat noise; Partnering with MSSP and internal incident response team members, IT, and engineering teams to close gaps discovered during investigations; Running targeted threat hunts and validation exercises to confirm detection coverage and document results; Updating playbooks/runbooks and coaching other analysts on investigation quality, documentation, and escalation standards Benefits: paragraph. Now produce HTML. We'll have:
About the role
We are seeking a Senior Security Analyst to strengthen and mature Security Operations (SOC) detection and response capabilities across enterprise, cloud, and third-party environments. This role is accountable for advanced alert triage, investigation, and incident analysis. The Senior Security Analyst partners closely with the incident response team, IT, and engineering teams to improve signal quality, close detection gaps, and strengthen operational readiness. The ideal candidate is a senior individual contributor with strong investigation skills, excellent judgment under pressure, and the ability to translate attacker behavior and telemetry into actionable response and detection improvements.
Responsibilities
- Performing threat-informed analysis of alerts and events, validating severity, scope, and business impact
- Applying threat intelligence and adversary tradecraft to prioritize, contextualize, and enrich investigations
- Identifying patterns of attacker behavior and emerging threats; translating findings into detection and response improvements
- Conducting advanced alert triage, investigation, and escalation across endpoint, network, identity, SaaS, and cloud telemetry
- Investigating identity, access, and configuration-related alerts (e.g., anomalous sign-ins, privilege changes, suspicious OAuth/app consent, policy changes)
- Supporting incident investigation and response activities, including containment recommendations and responder handoffs
- Collecting, preserving, and analyzing evidence; producing clear documentation suitable for incident reviews and potential legal/compliance needs
- Tuning detections and improving signal quality by reducing false positives, improving fidelity, and expanding meaningful coverage
- Analyzing detection gaps and control weaknesses surfaced through investigations; partnering with control owners to drive remediation
- Validating detection effectiveness through testing,