Our client is seeking an experienced Senior Analyst – Security Operations to join their security team. This role will focus on security monitoring, incident response, vulnerability management, threat detection, and purple team activities. The ideal candidate will have strong hands-on experience across modern security tools and be comfortable investigating complex incidents while collaborating with IT and engineering teams.

• Salary: $120K–$140K

Responsibilities:

Security Monitoring & Incident Response

• Monitor, triage, and investigate security alerts across SIEM, EDR, NDR, and cloud platforms, escalating to the SOC Lead as appropriate.
• Respond to security incidents end-to-end, including initial triage, containment, eradication, recovery, and post-incident documentation.
• Execute and help maintain incident response playbooks and runbooks, identifying gaps and recommending improvements.
• Conduct root cause analysis following incidents and contribute findings to post-incident reviews.
• Produce clear, accurate incident reports for both technical and non-technical audiences.
• Participate in an on-call rotation and respond to high-severity incidents outside of business hours when required.

Vulnerability Management

• Perform vulnerability scans and assessments using tools such as Tenable, Qualys, or Rapid7 on both scheduled and ad-hoc bases.
• Analyze and prioritize vulnerabilities using CVSS scores, threat intelligence, and asset criticality to guide remediation efforts.
• Track and follow up on remediation progress with IT and engineering teams, escalating stalled items as needed.
• Contribute to vulnerability reporting, including trends, patch compliance rates, and risk reduction metrics.
• Stay current on newly disclosed CVEs and exploit trends and advise on risk-based prioritization.

Purple Teaming & Threat Detection

• Participate in purple team exercises alongside red team operators to validate detection and response capabilities.
• Map adversary techniques to the MITRE ATT&CK framework and use exercise findings to identify detection gaps.
• Write and tune SIEM detection rules, correlation queries, and alerts based on adversary TTPs and purple team outcomes.
• Conduct threat hunting exercises using hypothesis-driven and ATT&CK-aligned methodologies to identify undetected threats.
• Track emerging threat actor activity and incorporate relevant TTPs into detection logic and hunting campaigns.

Security Operations & Collaboration

• Analyze logs from endpoints, firewalls, proxies, cloud platforms, and identity systems.
• Enrich investigations with threat intelligence, including IOCs, and correlate activity across multiple data sources.
• Collaborate with IT and engineering teams to tune security controls, reduce false positives, and improve signal quality.
• Maintain accurate SOC documentation, including runbooks, knowledge base articles, and escalation procedures.
• Support compliance activities such as SOC 2, ISO 27001, and NIST CSF by providing evidence and participating in audits as required.
• Mentor junior analysts by sharing knowledge and providing guidance on investigations and tool usage, without formal management responsibility.

Required Qualifications:

• 5+ years of hands-on experience in a SOC, security operations, or incident response role.
• Strong proficiency with SIEM platforms such as Splunk, Microsoft Sentinel, or Sumo Logic.
• Hands-on experience with EDR solutions such as CrowdStrike Falcon or Microsoft Defender.
• Hands-on experience configuring conditional access policies in Entra or another identity platform.
• Hands-on experience configuring DLP policies in Microsoft Purview or another platform.
• Demonstrated experience triaging and responding to a significant volume of security alerts and incidents.
• Working knowledge of vulnerability management tools and processes, including scanning, prioritization, and remediation tracking.
• Solid understanding of network protocols and fundamentals, including TCP/IP, DNS, HTTP/S, firewalls, and proxies.
• Experience analyzing logs across endpoints, networks, cloud environments, and SaaS platforms.
• Familiarity with the MITRE ATT&CK framework and applying it to investigations and detection engineering.
• Scripting experience for investigation and automation tasks using Python, PowerShell, or Bash.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Excellent written and verbal communication skills, with the ability to convey technical findings clearly to varied audiences.

Preferred Qualifications:

• Experience participating in purple team, red team, or adversary emulation exercises.
• Background in threat hunting using hypothesis-driven or behavior-based methodologies.
• Exposure to SOAR platforms and security automation or workflow development.
• Experience with cloud security telemetry and threat models across AWS, Azure, or GCP.
• Familiarity with threat intelligence platforms or workflows such as MISP, Recorded Future, or OpenCTI.
• Knowledge of digital forensics tools and techniques, including KAPE, Volatility, or Velociraptor.

Certifications

Required or Strongly Preferred:

• Required: CISSP – Certified Information Systems Security Professional
• Preferred: GIAC GCIH – GIAC Certified Incident Handler
• Preferred: GIAC GCIA – Intrusion Analyst
• Preferred: CEH – Certified Ethical Hacker
• Preferred: CompTIA CySA+ or Security+
• Preferred: OSCP, GPEN, or similar offensive/detection-focused certification
• Preferred: Cloud security certifications such as Microsoft SC-200, AWS Security Specialty, or equivalent

If you meet the required qualifications and are interested in this role, please apply today. 

The Solomon Page Distinction

Our teams, comprised of subject matter experts, develop an interest in your preferences and goals and we act as an advisor for your career advancement. Solomon Page has an extensive network of established clients which allows us to present opportunities that are well-suited to your respective goals and needs – this specialized approach sets us apart in the industries we serve.

About Solomon Page

Founded in 1990, Solomon Page is a specialty niche provider of staffing and executive search solutions across a wide array of functions and industries. The success of Solomon Page reflects an organic growth strategy supported by a highly entrepreneurial culture. Acting as a strategic partner to our clients and candidates, we focus on providing customized solutions and building long-term relationships based on trust, respect, and the consistent delivery of excellent results. For more information and additional opportunities, visit: solomonpage.com and connect with us on Facebook, and LinkedIn.

Opportunity Awaits.