Remote part-time work for experienced SOC analysts. You put your investigative judgment to work on security cases across SIEM, endpoint, cloud and identity data, deciding which alerts are real and building full investigations in Splunk.
What you will do
- Review and evaluate SOC alerts and investigation outputs against set scenarios and criteria.
- Separate true positives from false positives by checking the evidence and alert context.
- Run full investigations when needed: log analysis, entity pivoting, timeline reconstruction and evidence correlation.
- Judge whether investigations from automated or human workflows are correct and complete, and give clear accept or pass decisions.
- Pivot across logs, entities and timelines in Splunk, and read and reason about SPL queries.
- Document your steps, assumptions, evidence and conclusions clearly.
- Work with program leads and other expert reviewers, and support other analysts in longer-term or lead roles.
What you need
- 3+ years of hands-on work as a SOC analyst in a production SOC. Tier 2 or above counts strongly in your favour.
- A strong grasp of alert triage, incident investigation and evidence-based decisions under time pressure.
- Hands-on Splunk experience is mandatory: running investigations, reading SPL and pivoting between logs, entities and timelines.
- Proven skill at judging whether an investigation's conclusions are valid, incomplete or wrong.
- Fluent written and spoken English, with strong documentation skills.
Nice to have: EDR tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint or SentinelOne; cloud security logs from AWS, Azure or GCP; Okta or Microsoft Entra ID; Proofpoint or Mimecast; SOC leadership; basic Python scripting; security certifications such as GCIA, GCIH, GCED, Splunk, Security+ or CCNA.
How pay works
This role is paid by the hour, at a listed rate of $70-95/hr.
Apply (opens in a new tab)