SOC Analyst II

You serve as the escalation point for Level 1 analysts in the Security Operations Center, performing in-depth investigations into escalated alerts and confirmed security incidents. You determine root cause, scope, and impact, lead containment and remediation for medium- and high-severity incidents within your authority, and coordinate with IT and business teams to restore normal operations.

SRI Resources (a 24 Seven Company) has an immediate, contract job opportunity for a SOC Analyst II with a major corporation, on-site in Irving/Dallas, TX.

12+ month contract

Summary:
You serve as the escalation point for Level 1 analysts in the Security Operations Center, performing in-depth investigations into escalated alerts and confirmed security incidents. You determine root cause, scope, and impact, lead containment and remediation for medium- and high-severity incidents within your authority, and coordinate with IT and business teams to restore normal operations. You develop and tune detections, contribute to response automation and playbooks, and mentor Level 1 analysts. You escalate critical or highly complex incidents to Level 3 analysts, the SOC Manager, and incident response leadership.

Key Responsibilities:
Investigate escalated alerts and incidents

• Serve as the primary escalation point for Level 1 analysts, validating triage decisions and taking ownership of escalated alerts
• Perform in-depth investigations across endpoint, network, identity, email, and cloud telemetry to determine root cause, scope, and impact
• Build incident timelines by correlating data across Splunk ES, Palo Alto Cortex, and supporting log sources
• Assess incident severity and business impact, and escalate to Level 3 analysts or incident response leadership when defined thresholds are met

Lead containment and response

• Lead containment, eradication, and recovery for medium- and high-severity incidents within defined authority, including host isolation, account disablement, and IOC blocking
• Coordinate with IT infrastructure, identity, and application teams to execute and verify remediation actions
• Collect and preserve forensic evidence such as logs, endpoint artifacts, and memory captures, and maintain chain-of-custody documentation
• Write incident reports summarizing root cause, actions taken, and recommendations, and contribute findings to post-incident reviews

Improve detection and automation

• Develop new detection rules and correlation searches in Splunk ES mapped to MITRE Telecommunication&CK techniques
• Tune detections based on false-positive trends and alert metrics, validating changes against historical data before deployment
• Identify repetitive analyst tasks and help build or enhance Cortex XSOAR playbooks for enrichment and response automation
• Operationalize threat intelligence by converting IOCs and TTPs into searches, watchlists, and detections
• Conduct hypothesis-driven threat hunts on emerging threats with guidance from Level 3 analysts

Mentor analysts and strengthen SOC operations

• Mentor and coach Level 1 analysts, reviewing ticket quality and providing feedback on investigation and documentation practices
• Create and update SOPs, playbooks, and runbooks based on investigation findings and lessons learned
• Track and report SOC metrics such as mean time to detect (MTTD), mean time to respond (MTTR), escalation accuracy, and false-positive rates
• Participate in the on-call rotation as an escalation resource and contribute to tabletop exercises and drills

Tools and Technologies You Might Use

• SIEM: Splunk ES, including SPL searches, correlation searches, and dashboards
• EDR: Palo Alto Cortex, including live response and host isolation
• SOAR and ticketing: Palo Alto Cortex XSOAR, ServiceNow, Jira
• Network security: firewalls, IDS/IPS, proxy and DNS logs, packet capture analysis (e.g., Wireshark)
• Identity and email: Active Directory / Entra ID authentication logs, email security gateway logs
• Threat intelligence and analysis: VirusTotal/Google Threat Intelligence, Recorded Future, malware analysis sandboxes
• Frameworks: MITRE Telecommunication&CK, NIST incident response lifecycle, Cyber Kill Chain

Examples of Work and Technical Scope

• Investigate an escalated phishing campaign affecting multiple users, identify all recipients and clicks, and coordinate mailbox purges and credential resets
• Analyze a suspicious PowerShell or living-off-the-land execution chain to determine initial access, persistence, and any lateral movement
• Build a Splunk correlation search to detect impossible-travel or anomalous MFA activity and validate it against historical data
• Lead containment of a malware infection across several endpoints, including isolation, IOC sweeps, and verification of eradication
• Develop a Cortex XSOAR playbook that automates IOC enrichment for phishing alerts to reduce Level 1 handling time
• Review a week of Level 1 tickets and deliver coaching feedback on triage accuracy and documentation quality

Required Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or equivalent experience
• 3-5 years of experience in security operations, incident response, or a related cybersecurity role, including at least 2 years as a SOC analyst
• Hands-on experience investigating incidents using SIEM and EDR platforms, including writing search queries (e.g., Splunk SPL)
• Solid understanding of Windows and Linux operating systems, Active Directory, and common log sources such as Windows Event Logs, Sysmon, firewall, and proxy logs
• Working knowledge of networking and protocols, including TCP/IP, DNS, HTTP/S, and SMTP, with the ability to analyze network traffic
• Practical experience applying MITRE Telecommunication&CK to investigations and detection development
• Ability to lead response for medium- and high-severity incidents and communicate clearly with technical and non-technical stakeholders
• Strong written communication skills for incident reports, playbooks, and procedures
• Willingness to work shift-based coverage and participate in on-call rotation as an escalation resource
• Experience with scripting or automation tools such as PowerShell, Python, or XQL for Cyber defense Operation and Investigation
• Ability to develop, execute queries (e.g., SPL, XQL) and scripts (Python, PowerShell) using VS Code for log analysis, and automated simulation of security scenarios to validate detection rules
• Experience monitoring deployed detections for failures, query errors, and logic gaps; investigate detections that stop triggering.
• Experience conducting attack simulations and evaluating detection coverage, alert accuracy, and effectiveness to drive continuous improvements.

Preferred Qualifications:

• Industry certifications such as CompTIA CySA+, GIAC GCIH, GIAC GCIA, or Splunk Certified Cybersecurity Defense Analyst
• Scripting experience in Python or PowerShell to automate enrichment, log parsing, or response tasks
• Experience building or maintaining SOAR playbooks, preferably in Cortex XSOAR
• Experience monitoring cloud and SaaS environments (e.g., AWS, Azure, Google Cloud, Microsoft 365)
• Experience working in retail, payments, or PCI DSS-regulated environments

About SRI Resources

SRI Resources, founded more than 3 decades ago, is a trusted staffing partner specializing in Technology (IT, Creative, & Marketing), Finance, & Accounting placements. We work with companies nationwide that need skilled professionals and connect them with candidates like you looking for the right opportunity. We are always looking for professionals at all experience levels and in various specialties to meet our clients' hiring needs. As a member of our team, you will have access to benefits including medical, dental, and vision coverage, a 401(k) with company match, short-term disability, life insurance with AD&D. If this position fits interests you, we encourage you to apply. You can view all our job openings at SRI Resources Careers.