Tier 2 SOC Analyst — Contract, Part-Time, Remote

About the role

We are a managed security services provider seeking an experienced Tier 2 analyst to cover a defined window on a dedicated client account — a public-sector transportation agency with a mature, well-instrumented security stack. You will work alongside our wider SOC team, owning triage, containment, and investigation during your coverage window.

Responsibilities

• Triage and disposition alerts and SOAR cases on the account queue, meeting agreed response targets by priority
• Execute containment and remediation actions in line with established playbooks
• Investigate escalated cases across endpoint, identity, email, and network telemetry, including forensic artifact review where warranted
• Apply threat intelligence and indicators of compromise during triage
• Identify false positives and submit tuning recommendations that reduce alert noise
• Produce case documentation to a standard suitable for client review
• Provide a written handoff at the close of your window
• Contribute to runbook and knowledge base content for the account environment

Platforms

• SIEM, SOAR case queue
• EDR / Identity
• Email Security
• Microsoft Defender for Cloud Apps, Defender for Office 365, and Entra ID

Requirements

• 3–5 years in a SOC or security operations role, with proven ability to work a queue and make disposition decisions independently
• Strong proficiency with EDR/XDR platforms and SIEM triage workflows
• Endpoint and network artifact analysis — registry entries, file system activity, event logs
• Malware triage and behavioral analysis, including sandbox tooling such as VirusTotal or Any.run
• Working knowledge of attacker tradecraft mapped to MITRE ATT&CK
• Sound escalation judgment, with the context to justify decisions
• Clear, structured written documentation — case notes are read by the client

Helpful, not required: direct experience with Google SecOps / Chronicle or CrowdStrike Identity Protection; scripting (PowerShell, Python, Bash, or SQL); detection tuning; prior MSSP or public sector experience.