Security Operations Center Analyst

Optomi, in partnership with a client in the AI space, is seeking a Senior Security Operations Analyst to join their team. This role is ideal for a seasoned professional with deep SOC and incident response experience who thrives in a dynamic, small-team environment where they can wear multiple hats.

The right candidate will bring 5–8+ years of IT experience, with 2–4 years in security operations or incident response, and must already be working in a senior-level incident response role, handling escalated alerts from start to finish—including hands-on remediation.

Key Responsibilities

• Monitor, triage, and investigate alerts from SIEM, EDR, email security, and other monitoring tools.
• Lead response for medium-to-high severity security incidents.
• Conduct root cause analysis and deliver detailed post-incident reports.
• Collaborate with IT teams to contain, eradicate, and remediate threats.
• Develop custom detection rules, dashboards, and reports.
• Manage vulnerability lifecycle from scanning to remediation tracking.
• Validate and prioritize vulnerabilities based on exploitability and business impact.
• Provide clear, actionable security guidance to IT/business stakeholders.
• Mentor Tier 1 analysts and MSSP resources.
• Maintain and enhance incident response runbooks and escalation workflows.
• Recommend process and tooling improvements for SOC efficiency.

Qualifications

Required

• 5–8+ years of IT experience with 2–4 years in security operations or incident response.
• Senior-level incident response experience, handling escalations end-to-end.
• Hands-on expertise with SIEM, EDR, and network security tools.
• Strong knowledge of MITRE ATT&CK framework, threat actors, and IR best practices.
• Experience with vulnerability management workflows.
• Ability to analyze logs, packets, and system behaviors to identify malicious activity.
• Scripting skills (Python, PowerShell, or Bash) for automation.
• Strong written and verbal communication skills.

Preferred

• Experience in small-team or startup-like environments with cross-functional responsibilities.
• Familiarity with cloud security (AWS, Azure, or GCP).
• Industry certifications (Security+, CySA+, GCIH, GCIA, or similar).

Why Join?
This is a high-impact role where you’ll lead investigations, drive improvements, and directly influence the organization’s security posture. You’ll have the opportunity to work in a smaller, agile team environment, gaining exposure across multiple security domains while supporting cutting-edge AI technologies.