[Hiring] SOC Analyst II @Sentinel Blue

Role Description

Sentinel Blue is seeking a Security Operations Center (SOC) Analyst II to join our Overwatch Team. In this role, the SOC Analyst II will lead the analysis, containment, and remediation of complex threats that extend beyond initial triage.

• Manage concurrent investigations across a multi-tenant client base.
• Determine scope of impact and investigate incidents from detection through resolution.
• Think like an attacker and reconstruct how compromises occurred.
• Drive improvements to workflows, playbooks, and documentation.
• Help advance capabilities in digital forensics and incident response (DFIR), threat hunting, vulnerability management, and threat intelligence.
• Collaborate and mentor junior staff to drive innovation.

This is a full-time position that is fully remote. Due to the nature of our work, you must be a U.S. citizen with eligibility for a clearance. No exceptions.

Qualifications

• Minimum of 2-5 years of experience in a Security Operations Center and/or a combination of experience in cyber-adjacent or IT administration roles.

Requirements

• U.S. citizenship - by nature of our work with the defense industry, all employees must be eligible for a Secret clearance.
• Serve as the primary escalation point for Tier I analysts and take ownership of critical/high-severity alerts and escalated security incidents.
• Analyze endpoints, network traffic, and other log data to validate security incidents and perform root cause analysis.
• Lead containment, eradication, and recovery during active security incidents, ensuring Standard Operating Procedures (SOPs) and Incident Response (IR) Plans are followed and documented.
• Reconstruct attack chains, utilizing the MITRE ATT&CK Framework and Cyber Kill Chain to map adversary tactics, techniques, and procedures (TTPs).
• Conduct intelligence and/or hypothesis-driven threat hunts across environments to detect advanced threats that evade security tools and controls.
• Write executive reports with a clear narrative structure, detailed analysis, and actionable recommendations.
• Manage the vulnerability management lifecycle by analyzing scan results, prioritizing critical vulnerabilities based on risk and exploitability, and coordinating remediation efforts with IT/Engineering.
• Develop and maintain IR playbooks and SOPs to ensure consistent and efficient event handling.
• Provide technical guidance, training, and feedback to Tier 1 analysts to improve their triage capabilities and knowledge.
• Participate in an on-call rotation to provide coverage for critical security incidents outside of standard business hours.

Knowledge & Skills

• Incident Response: Perform deep dives, event correlation across logs, host and network artifacts for root cause analysis and respond across the IR lifecycle with remediation/containment actions.
• Windows OS Internals: Intermediate to advanced understanding of various components and internal workings of the Windows OS such as Event Tracing for Windows, Win32 API, the Registry, Memory, and Process operations.
• Attack Lifecycles & Frameworks: Map adversary tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework.
• Threat Intelligence Integration: Correlate incidents with threat feeds using Indicators of Compromise (IoCs), threat actor attribution, and vulnerability exploitation patterns.
• Networking & Protocols: Intermediate to advanced understanding of common network protocols such as TCP/IP, DNS, HTTP, SSL/TLS, etc.
• Scripting & Automation: Intermediate to advanced writing and interpretation of Python or PowerShell scripts to parse logs or automate manual, repetitive tasks. Other scripting languages are beneficial as well.
• System Administration: Ability to safely manage Windows devices via the command line using PowerShell or Batch.
• Basic Malware Analysis: Ability to detect and reverse engineer malicious scripts or other high-level languages. Understanding of various code injection techniques and other attack/evasion techniques as they relate to Windows.
• Tools: Prior experience with SIEM platforms such as Microsoft Sentinel, ELK/Elastic Stack, Splunk, etc.; Hands-on experience with Sysinternals Suite (Process Explorer, Autoruns, etc.); Volatility; SIFT Workstation; CyberChef; Forensic Browser for SQLite; Velociraptor; Explorer Suite; Wireshark; malware analysis sandboxes, etc. Other equivalent tools are acceptable.
• Adversarial Tradecraft: Familiarity with trending malware development, social engineering, phishing, exploitations, persistence, evasion techniques, credential theft, C2, exfiltration, and lateral movement.

Desired Qualifications

• Possession of intermediate to advanced certifications such as: GCIH/GCIA/GCFA, OSCP, BTL2, or equivalent is highly desired.
• Previous experience in a team lead or supervisory leadership capacity, demonstrating the ability to drive operational goals, manage complex escalations, and effectively mentor junior staff.
• Experience with Azure, Microsoft Sentinel/Defender XDR, Entra ID, and Kusto Query Language (KQL).
• Active participation in Capture-the-Flag (CTF) events and homelabbing, a plus.
• Understanding of various low-level mechanics such as x64 assembly, Windows data structures, and researching undocumented parts of the Windows OS.
• Familiarity with low-level reverse engineering, debugging, and related tools such as Ghidra, x64dbg, IDA, etc.

Benefits

• Fully paid individual healthcare, vision, and dental insurance for the employee.
• Paid certification and training opportunities.
• Three weeks of paid vacation + 11 paid holidays.
• A supportive environment with a focus on keeping healthy work-life balance.
• Retirement benefit (401k) with company match.