{"id":2212149,"url":"https://alion.io/job/osibeyond-security-operations-center-soc-analyst-remote-2","title":"Security Operations Center (SOC) Analyst - Remote","company":{"id":3875980,"name":"OSIbeyond","domain":"osibeyond.com","url":"https://alion.io/company/osibeyond","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"BambooHR","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"DNS","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Tines","optional":false},{"name":"VPN","optional":false},{"name":"Windows Server","optional":false},{"name":"Microsoft Teams","optional":true},{"name":"SentinelOne","optional":true}],"status":"live","first_seen_at":"2026-10-08T00:00:00Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-10-26T11:18:34Z","board_verified":true,"closed_at":null,"days_open":18,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":18},"description":"Since 2004, OSIbeyond has delivered managed technology and cybersecurity services on a founding principle: outstanding technical expertise, matched by an exceptional customer experience. Today, that commitment is delivered through OSIbeyond ONE, our integrated technology platform that unifies IT operations, cybersecurity, Microsoft 365, cloud, automation, AI, and expert support into a single, continuously managed environment. The platform is built on a clear operating philosophy: Automation First. AI Enabled. People Powered.\nThe OSIbeyond Security Operations Center is the cybersecurity engine of that platform. It provides continuous detection, investigation, and response across a diverse portfolio of client environments, including organizations subject to federal compliance frameworks such as CMMC and NIST SP 800-171. The SOC operates on a two-shift, automation-augmented coverage model. Human analysts staff the Day and Evening shifts, and a purpose-built automation layer operates overnight, backed by an on-call analyst, ensuring that every hour of every day is covered by a trained analyst or by an automated response workflow.\nThe SOC Analyst is the “People Powered” element of security operations. Automation handles the repetitive, high-volume work of enrichment, correlation, and first-response containment, so that the analyst’s time is concentrated on the work that requires human judgment: validating and investigating alerts, leading incident response, advising clients, and continuously improving detection and automation logic. The SOC engineering team is continuously expanding this automation capability, and analysts are expected to contribute to that evolution as active participants rather than passive users.\nThis position is suited to a technically accomplished security professional who values structure, precision, and accountability. The successful candidate demonstrates sound analytical judgment, disciplined documentation, professionalism in client communication, and a commitment to protecting client environments with the same care they would expect for their own.\nABOUT THE ROLE:\nThe SOC Analyst monitors, analyzes, and responds to cybersecurity threats across client environments. The analyst operates the SOC’s security tooling, investigates suspicious activity, contains and remediates confirmed incidents, and communicates findings clearly to clients and internal stakeholders.\nDuring each shift the analyst owns the live alert queue, triaging detections from the SIEM, endpoint, identity, and email security platforms; determining scope and severity; and executing or authorizing the appropriate response. Because the SOC operates on a shift model, the analyst is also responsible for the integrity of coverage: conducting structured handoffs at the end of each shift, reviewing existing alerts at the start of the Day shift, and ensuring that no detection, investigation, or client commitment is left without a clear owner.\nBeyond day-to-day operations, the analyst performs scheduled vulnerability scanning, conducts root cause analysis for security incidents, and identifies repetitive manual work that should be transitioned to automation. Performance is measured against response times, investigation quality, SLA adherence, documentation standards, and contributions to the continuous improvement of detection and automation.\nSCHEDULE & SHIFT MODEL:\nThe SOC operates a two-shift model with 12-hour shifts. Each analyst is assigned to a fixed shift (Day or Evening) and does not rotate between shift times. The two shifts overlap for six hours (11:00 AM to 5:00 PM), providing a structured handoff window and dual-analyst coverage during peak business hours. Overnight coverage (11:00 PM to 5:00 AM) is provided by the SOC’s Tines automation layer, which performs enrichment, containment, and escalation according to documented playbooks. Escalations that exceed the automation’s authority are routed to the on-call SOC Analyst.\nESSENTIAL DUTIES & RESPONSIBILITIES:\nSecurity Monitoring & Alert Triage (≈50%) \nMonitor client environments continuously for security threats using the SIEM, endpoint detection and response, identity protection, and email security platforms \nTriage inbound alerts by following the automated priority procedure; determine whether each detection represents a true positive, benign activity, or a tuning opportunity \nRespond to alerts where automation is unable to clearly determine legitimacy and/or severity. Work and complete assigned tickets in accordance with documented standard operating procedures and service level commitments \nIdentify recurring false positives and submit detection-tuning recommendations to the SOC Manager and automation team \nIncident Investigation & Response (≈25%) \nInvestigate security incidents including account compromise, business email compromise, social engineering, malware, and ransomware activity \nThrough automated means and manual review, analyze servers, workstations, identities, and other assets suspected of compromise and accurately assess the scope and type of the issue \nContain and remediate confirmed threats using approved automation workflows, scripts, policies, playbooks, and platform controls; escalate in accordance with the incident response plan when the situation exceeds the analyst’s authority or expertise \nProvide accurate, timely, and professionally written incident communications to designated client points of contact and internal stakeholders with the assistance of the SOC Manager or CISO \nVulnerability Management & Security Posture (≈10%) \nPerform regularly scheduled vulnerability scanning across client environmentsSupport client compliance objectives, including CMMC and NIST SP 800-171 requirements, by producing the monitoring evidence, logs, and reports required by those frameworks \nContribute to periodic client security reviews with clear, data-supported observations \nAutomation Oversight & Continuous Improvement (≈15%) \nReview the overnight Tines automation log at the start of the Day shift, confirm low confidence actions were appropriate, and remediate or escalate any exceptions \nWhile on call, respond to overnight escalations from the automation layer, take ownership of the incident, and document all actions taken for review at the start of the Day shift \nIdentify repetitive manual investigation and response steps and submit them to the automation team as candidates for new automations or expanded playbooks \nIdentify repetitive “false positives” for the SOC Manager to address \nTest and provide structured feedback on new detections and automation workflows before they are placed into production \nTrack and document all work in the ticketing system with detail sufficient for a peer to resume the work without additional context \nGeneral Responsibilities\nProvide high-quality written and verbal customer service in every client interaction \nMeet all key performance indicators and notify the SOC Manager promptly when workload or circumstances place a KPI at risk \nRecognize when an assignment should be escalated and escalate without delay \nSupport peers across both shifts and contribute to a collaborative, accountable team culture \nPerform other duties as assigned \nSUCCESS METRICS:\nMean time to acknowledge and mean time to respond for alerts during the assigned shift \nMean time to contain and mean time to resolve for confirmed incidents \nKPI adherence across all assigned tickets \nEscalation accuracy: incidents escalated at the appropriate severity and stage, with complete supporting documentation \nQuality of shift handoffs, measured by open items with a clear owner and no unattended investigations at shift change \nAccuracy of automated-action validation and exceptions correctly identified in the overnight automation review \nOn-call responsiveness: acknowledgment and response times for overnight escalations during assigned on-call weeks \nDetection tuning and automation candidates submitted and adopted \nDocumentation quality and completeness of ticket notes, incident reports, and root cause analyses \nClient satisfaction with incident communications and security reviews \nSECURITY RESPONSIBILITIES:\nComplete training for and maintain awareness of cybersecurity risks, including insider threat, and the appropriate handling of CUI and other regulated data \nTreat client data and OSIbeyond data as sensitive, and do not disclose, release, or otherwise transfer it outside of OSIbeyond or client environments without written permission \nFollow cybersecurity requirements as described in the Employee Handbook and other OSIbeyond policies \nImmediately follow incident response procedures when a security incident or concern is identified \nAssist with the escorting or monitoring of visitors when working onsite \nMonitor alerts from the SIEM and related security platforms, conduct vulnerability scans, and review and update logged events \nQUALIFICATIONS:\nExperience \nTwo or more years of experience in security operations, incident response, or systems administration with a demonstrable security focus; managed service provider experience is strongly preferred \nDemonstrated experience investigating and responding to identity, endpoint, and email-based threats in Microsoft 365 environments \nSecurity Operations Skills \nWorking knowledge of SIEM operations, log analysis, and alert triage methodology \nUnderstanding of common attack techniques and the MITRE ATT&CK framework, and the ability to map observed activity to adversary behavior \nFamiliarity with endpoint detection and response, identity protection, and email security controls and their remediation actions \nAbility to perform disciplined, well-documented investigations \nSystems & Network Knowledge \nSolid understanding of Microsoft 365 and Entra ID administration, including conditional access, authentication methods, and audit logging \nWorking knowledge of Windows server and workstation operating systems, Active Directory, and core networking concepts (TCP/IP, DNS, firewalls, VPN) \nFamiliarity with vulnerability scanning platforms and remediation workflows \nAutomation & Operational Skills \nComfort operating within an automation-first environment, including validating and troubleshooting the output of automated playbooks (Tines or comparable SOAR tooling) \nBasic scripting or query proficiency (PowerShell, KQL, or similar) sufficient to enrich investigations and validate data \nDisciplined ticket hygiene and documentation habits; ability to write clear, professional client-facing communications \nReliability and self-management appropriate to a remote, shift-based role with defined coverage responsibilities \nAdditional Desirable Qualifications \nExperience supporting clients subject to CMMC, NIST SP 800-171, or similar regulatory frameworks \nPrior experience contributing to detection engineering or automation playbook development \nExperience in a 24x7 or shift-based security operations environment \nKNOWLEDGE & CERTIFICATIONS\nTooling Environment: SIEM and extended detection and response platforms; Sentinel One and Blumira; Entra ID identity protection; Tines security automation; vulnerability scanning platform; Autotask professional services automation (ticketing); Microsoft Teams for internal collaboration.\nRequired Certifications (or attainment within the first six months) \nCompTIA Security+\nCompTIA Network+\nPreferred Certifications \nCompTIA SecurityX (CASP+) or other DoD 8140 Level II certification\nPosition:\nLocation - Remote from the United States, must be willing to work EST hours\nShift Schedule: 11:00am-11:00pm EST\nEmployment Type - Full time\nBenefits:\nMedical Insurance - OSIbeyond pays 75% of the premium for the Employee's base medical plan\nVision and Dental Insurance - OSIbeyond pays 75% of the premium for the Employee's plans\nLife Insurance - OSIbeyond pays 100% of the premium for the Employee's plans\nShort Term Disability Insurance - OSIbeyond pays 100% of the premium for the Employee's plans\n40...","description_format":"text","description_chars":12147,"description_truncated":true,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Dental insurance","Health insurance","Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Information Security","Managed IT Services (MSP)"],"lifecycle":[{"event":"open","at":"2026-10-10T03:41:59Z"}],"visa":[],"liveness":{"score":56,"band":"ok","label":"Likely open","p_open":1,"p_active":0.747,"p_room":0.75,"age_days":18,"expected_fill_days":20,"reasons":["conf:4","win:late","comp:junior"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/osibeyond-security-operations-center-soc-analyst-remote-2","json_url":"https://alion.io/job/osibeyond-security-operations-center-soc-analyst-remote-2.json","meta":{"generated_at":"2026-10-26T12:04:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16463,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3875980},"rest":"https://alion.io/mcp/rest/get_company?id=3875980"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fosibeyond-security-operations-center-soc-analyst-remote-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fosibeyond-security-operations-center-soc-analyst-remote-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fosibeyond-security-operations-center-soc-analyst-remote-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/osibeyond-security-operations-center-soc-analyst-remote-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fosibeyond-security-operations-center-soc-analyst-remote-2"}]}