SOC Analyst

Our client is looking for a SOC Analyst to strengthen their cybersecurity operations, investigate security threats, and ensure incidents are effectively managed from detection through resolution. They are an established U.S. law firm recognized for their continued growth, legal expertise, and commitment to delivering high-quality professional services. The ideal candidate is a proactive, hands-on security professional with 2–4 years of experience in security operations, incident response, and endpoint protection. This role requires someone who can independently evaluate alerts escalated by a Managed Security Service Provider (MSSP), take full ownership of security incidents, and strengthen security controls across Microsoft 365 and endpoint environments. Responsibilities Review, prioritize, and investigate security alerts escalated by the organization's Managed Security Service Provider (MSSP). Serve as the primary internal contact for security incidents, ensuring potential threats are promptly investigated and addressed. Take ownership of security tickets throughout their entire lifecycle, from initial investigation to complete resolution and documentation. Investigate suspicious activities, assess potential threats, and execute appropriate remediation procedures. Monitor, configure, and strengthen security controls within Microsoft 365 environments. Utilize endpoint detection and response (EDR) solutions to identify, contain, and remediate security threats. Work with Microsoft Defender, Microsoft Sentinel, SentinelOne, or comparable security technologies to support monitoring and incident response activities. Collaborate with external security providers and internal stakeholders to coordinate investigations and ensure proper incident resolution. Identify gaps in existing security configurations and recommend practical improvements. Support the review, development, and implementation of cybersecurity policies and procedures. Validate existing security controls to ensure they provide appropriate protection against emerging threats. Present security recommendations to relevant stakeholders and implement approved improvements. Maintain accurate documentation of security investigations, remediation actions, and ticket resolutions. Proactively identify opportunities to improve the organization's overall security posture and incident response processes. Requirements 2–4 years of professional experience in cybersecurity, security operations, SOC environments, or incident response. Hands-on experience with at least one of the following: Microsoft Defender, Microsoft Sentinel, or SentinelOne. Practical knowledge of endpoint detection and response (EDR) technologies. Experience investigating security alerts, identifying malicious activity, and responding to security incidents. Ability to manage security tickets independently from initial detection through final resolution. Knowledge of Microsoft 365 security configurations, threat protection, and security best practices. Experience implementing remediation actions and verifying successful incident resolution. Strong understanding of security monitoring, threat detection, and incident response workflows. Ability to evaluate security risks and recommend appropriate corrective actions. Strong analytical, troubleshooting, and problem-solving capabilities. Ability to prioritize security incidents and work independently with minimal supervision. Strong communication skills to explain security findings and recommendations to technical and nontechnical stakeholders. Advanced English proficiency for communication with a U.S.-based team. Availability to work during Eastern Time business hours. Qualifications Educational background or equivalent practical experience in Cybersecurity, Information Technology, Computer Science, Information Security, or a related field. Experience collaborating with Managed Security Service Providers (MSSPs). Familiarity with Security Information and Event Management (SIEM) platforms and security alert correlation. Knowledge of cybersecurity policies, security hardening, and risk mitigation. Experience working in security operations environments handling sensitive or confidential information. Familiarity with security frameworks and industry best practices, such as NIST or CIS Controls. Knowledge of identity and access management within Microsoft environments. Certifications such as Microsoft SC-200, CompTIA Security+, or other relevant cybersecurity credentials are a plus. Demonstrated ability to take initiative, investigate technical problems, and implement effective security improvements. Benefits Full-time position, 100% remote. Working schedule: 9:00 AM to 6:00 PM Eastern Time, with approximately one hour of flexibility in either direction. Opportunity to collaborate with an established U.S.-based organization.