Principal SOC Analyst
Confirmed on the employer's own hiring board on Nov 1, 2026. First seen by Alion on Oct 31, 2026. Integrity360 scores B on the Alion truth index.
Join our team as a Principal SOC Analyst, where you will act as a Level 3 escalation point within the MDR/SOC function. You will provide advanced technical support to Level 2 analysts during complex or high-severity investigations, and contribute to the continuous improvement of the MDR service. This role requires strong hands-on experience in security operations, incident response, threat analysis, and detection tuning. You will also support the development of Operational Technology (OT) security monitoring and incident response capabilities.
Missions
- Act as a Level 3 escalation point for advanced security investigations, providing technical guidance and direction to Level 2 analysts.
- Lead advanced incident investigations, including scoping, containment, eradication, and remediation recommendations, while performing in-depth analysis of security events.
- Contribute to the continuous improvement of the MDR service by supporting the definition of security monitoring strategies, improving detection logic, and tuning security technologies.
Profil recherché
- Ability to analyse endpoint, network, identity, cloud and application telemetry in support of complex investigations- Experience with OT security platforms or NDR (e.g. Armis, Nozomi, Clarity, Dragos, Darktrace) is a plus
- Understanding of IT/OT convergence challenges and network segmentation practices (e.g. IEC 62443)
- Experience with cloud security monitoring across Microsoft Azure, AWS or Google Cloud is beneficial
- Experience supporting industrial or critical infrastructure environments is a plus
- Strong experience with security event triage, correlation, investigation and escalation
- Minimum 2-3 years of experience in a SOC, MDR, incident response, CSIRT or cyber security operations role
- Experience supporting customer-facing technical discussions, including investigation reviews, tuning recommendations and posture improvement activities
- Working knowledge of SIEM, EDR, SOAR, NIDS, DLP and threat intelligence platforms
- Knowledge of OT threat landscape and frameworks (e.g. MITRE ATT&CK for ICS)
- Ability to produce clear technical documentation, investigation reports and customer-facing recommendations
- Strong understanding of incident response lifecycle, including preparation, identification, containment, eradication, recovery and lessons learned
- Strong understanding of attacker tactics, techniques and procedures, including MITRE ATT&CK
- Experience supporting customers or internal stakeholders with security optimization, detection tuning and cyber security posture improvement
- Understanding of OT / ICS environments (SCADA, DCS, PLCs, HMIs, industrial networks)
- Ability to perform host-based and network-based threat analysis
- Deep operational knowledge of SIEM, EDR, Network Intrusion Detection Systems, SOAR, DLP and related security monitoring technologies
- Strong understanding of enterprise network architecture, TCP/IP, firewalls, proxies, VPNs, DNS, email security and cloud environments
- Experience analysing packet captures, endpoint artefacts, logs, scripts, documents and potentially malicious files
- Experience with Microsoft Sentinel, Microsoft Defender, Splunk, QRadar, CrowdStrike, SentinelOne, Palo Alto, Suricata, Zeek, Snort or similar technologies is highly beneficial
- Strong hands-on experience in Security Operations Centre or MDR environments
- Experience with threat hunting, detection engineering or purple team activities is beneficial
- Ability to manage multiple complex incidents and make effective decisions under pressure
- Experience working with threat hunting methodologies and security detection frameworks
- Strong written and verbal communication skills, with the ability to explain technical findings to both technical and non-technical stakeholders
- Proven experience handling complex security incidents and supporting advanced investigations
- Experience with SIEM query languages and detection logic, such as KQL, SPL, Sigma or equivalent
- Familiarity with industrial protocols (e.g. Modbus, OPC, IEC 104, DNP3) is beneficial
- Understanding of security protocols, encryption technologies and common authentication mechanisms
- Experience tuning security controls and detection content to improve alert fidelity and reduce false positives
- Security industry certifications such as GCIH, GCFA, GCIA, GNFA, GCTI, GSEC, CISSP, CySA+, SC-200, AZ-500 or equivalent are highly beneficial
- OT-related certifications or training (e.g. GICSP, GRID, IEC 62443) are advantageous