Note: The job is a remote job and is open to candidates in USA. BeyondTrust is a global leader in privileged access management and identity security, providing cybersecurity SaaS solutions that protect enterprise environments and customer systems. The Senior SOC Analyst will monitor, investigate, and respond to security events while contributing to detection engineering, threat intelligence, AI-augmented workflows, incident response, and operational improvement.ResponsibilitiesMonitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environmentsInvestigate alerts to determine scope, severity, and whether escalation is warrantedLeverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detectClassify, document, and track alerts through the full lifecycle using ticketing and case management systemsParticipate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communicationConduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructureExecute established IR runbooks across identity, endpoint, cloud, and email investigation workflowsManage or assist with evidence handling, forensic artifact collection, and chain-of-custody proceduresProduce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiencesContribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gapsTranslate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectorsHelp maintain and evolve detection coverage mapped to MITRE ATT&CKPartner with threat hunting peers to validate detection logic through hypothesis-driven huntsUse AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operationsContribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflowsAssist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effortPartner with engineering teams to improve log ingestion, data quality, and tool integrationsMaintain daily operational notes and shift handoff documentationContribute to and refine IR runbooks, playbooks, and standard operating proceduresParticipate in on-call rotation for after-hours incident escalationTrack and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunitiesParticipate in tabletop exercises, purple team activities, and post-incident reviewsSkills2+ years of experience in a SOC, security operations, or incident response roleUnderstanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behaviorExperience with at least one SIEM platform and familiarity with writing search or detection queriesFamiliarity with EDR platforms and cloud environments (IaaS preferred)Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflowsStrong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiencesExperience leading or co-leading complex incident response engagements from triage through remediationExperience with identity and access management platforms and cloud security posture management toolsScripting and automation skills (Python, PowerShell, or equivalent) applied to security workflowsFamiliarity with SOAR platforms or orchestration tools for automated response and enrichmentExperience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use casesExperience building or contributing to threat intelligence programs or detection-as-code pipelinesUnderstanding of the privileged access management landscape and the threat actors that target itTrack record of evaluating and adopting emerging technologies in a production security environmentBenefitsFlexible work cultureContinual learning opportunitiesCompany OverviewBeyondTrust is the global identity security leader protecting Paths to Privilege™ with an identity-centric approach. It is a sub-organization of Bomgar. It was founded in 1985, and is headquartered in Atlanta, Georgia, USA, with a workforce of 1001-5000 employees. Its website is http://www.beyondtrust.com.Company H1B SponsorshipBeyondTrust has a track record of offering H1B sponsorships, with 3 in 2025, 1 in 2024, 3 in 2022, 1 in 2020. Please note that this does not guarantee sponsorship for this specific role.
Apply To this Job
Location: , ,
USA Remote Jobs Mysmartpros: Apply Here