It’s our mission to protect, detect, support, and change the technology that runs your business, helping you to thrive in a sophisticated cyber environment.

Contact Info

Contact Us

Level 1 Security Operations Center (SOC) Analyst

Future Opportunity — Not Currently Hiring

Position Overview

NOCDOC is seeking a motivated Level 1 Security Operations Center (SOC) Analyst to join our 24×7 Cybersecurity Operations team. This role serves as the first line of defense against cybersecurity threats by monitoring, analyzing, triaging, and escalating security events across customer environments.

As a Level 1 SOC Analyst, you will continuously monitor security alerts generated by Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR/XDR), firewalls, identity platforms, cloud services, and other security technologies. You will investigate suspicious activity, perform initial incident analysis, document findings, follow established response procedures, and escalate confirmed or complex threats to senior SOC engineers when appropriate.

The ideal candidate has a passion for cybersecurity, enjoys investigating security events, and possesses strong analytical and troubleshooting skills. This role provides an excellent opportunity to develop hands-on experience in threat detection, incident response, security operations, and managed security delivery while working alongside experienced cybersecurity professionals.

This position may be performed remotely or from our office facilities. Candidates must be comfortable supporting a 24×7 Security Operations Center, including scheduled evening, overnight, weekend, holiday, and on-call rotations as required.

Key Responsibilities

Security Monitoring & Alert Triage

  • Answer incoming phone calls related to security alerts, customer inquiries, and incident coordination as part of SOC coverage
  • Own assigned security tickets from creation through resolution, ensuring accurate documentation and timely completion within SLA
  • Continuously monitor SIEM, EDR/XDR, firewalls, IDS/IPS, Microsoft Defender, Microsoft Sentinel, Microsoft 365, identity platforms, and other security monitoring technologies
  • Triage security alerts and determine severity, priority, and appropriate response actions based on established procedures
  • Investigate suspicious user activity, endpoint events, authentication anomalies, malware detections, and network security alerts
  • Analyze endpoint, network, cloud, and identity-related security events
  • Identify indicators of compromise (IOCs) and suspicious activity patterns

Incident Investigation & Response Support

  • Perform initial incident analysis and escalate validated security incidents to Level 2 SOC Engineers and senior analysts
  • Follow established incident response playbooks, Standard Operating Procedures (SOPs), and escalation processes
  • Document investigations, evidence, analysis, response actions, and recommendations within the ticket management system
  • Assist with security response activities including malware investigations, endpoint isolation procedures, account compromise investigations, and recovery activities following established SOC procedures
  • Support security incident coordination with internal teams and customer stakeholders when required

Threat Detection & Security Operations

  • Use threat intelligence, security frameworks, and available tooling to support investigation and classification of security events
  • Apply the MITRE ATT&CK Framework to assist with understanding attacker behavior and investigation context
  • Participate in threat hunting activities, vulnerability remediation support, and continuous security monitoring initiatives
  • Identify recurring security issues and recommend opportunities for process improvement

Cross-Functional Collaboration

  • Collaborate with NOC, Service Desk, Infrastructure, Engineering, and Security teams during security investigations and operational events
  • Support knowledge sharing and documentation improvements across operational teams
  • Maintain accurate incident records, knowledge base articles, investigation notes, and operational documentation

Required Qualifications

  • 1–3 years of experience in a Security Operations Center (SOC), Network Operations Center (NOC), Help Desk, IT Support, or related technical role
  • Fundamental understanding of cybersecurity concepts including incident response, malware, phishing, endpoint security, identity security, network security, and security monitoring concepts
  • Basic understanding of TCP/IP networking, DNS, DHCP, VPN, and Windows environments
  • Experience reviewing system, security, application, or event logs
  • Familiarity with Active Directory and Microsoft Entra ID
  • Understanding of common security frameworks and concepts, including CIS Controls, NIST Cybersecurity Framework, or similar security standards
  • Strong analytical, troubleshooting, and critical thinking skills
  • Excellent written and verbal communication skills
  • Ability to prioritize incidents while meeting SLA requirements
  • Strong attention to detail and commitment to accurate documentation

Preferred Qualifications

  • Experience working with SIEM platforms
  • Experience with Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon, SentinelOne, Sophos, or similar security platforms
  • Familiarity with MITRE ATT&CK Framework
  • Experience supporting Microsoft 365 security technologies
  • Experience with identity security concepts including authentication monitoring, MFA, and suspicious sign-in analysis
  • Experience within a Managed Security Services Provider (MSSP) or Managed Service Provider (MSP)
  • Familiarity with ticketing systems, incident management processes, and SLA-driven operations

Preferred Certifications (preferred but not required; equivalent combinations of education, certifications, and professional experience will be considered)

  • CompTIA Security+
  • CompTIA CySA+
  • ISC2 Certified in Cybersecurity (CC)
  • Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
  • Microsoft Azure Fundamentals (AZ-900)
  • CompTIA Network+
  • Splunk Core Certified User
  • ITIL 4 Foundation

Technical Skills

Security Operations

  • SIEM
  • EDR/XDR
  • Incident response processes
  • Threat detection
  • Threat intelligence
  • Security event monitoring
  • Log analysis
  • IOC identification
  • MITRE ATT&CK Framework
  • CIS Controls awareness
  • NIST Cybersecurity Framework concepts

Identity Security

  • Microsoft Entra ID security events
  • Authentication monitoring
  • MFA concepts
  • Conditional Access concepts
  • Account compromise indicators
  • Identity-based attack techniques

Infrastructure

  • Windows Server
  • Windows 10/11
  • Active Directory
  • Microsoft Entra ID
  • Microsoft 365
  • DNS
  • DHCP
  • TCP/IP
  • VPN

Security Technologies

  • Microsoft Sentinel
  • Microsoft Defender XDR
  • Microsoft Defender for Endpoint
  • Firewalls
  • IDS/IPS
  • MFA
  • Endpoint protection
  • Email security technologies

Professional Skills

  • Analytical thinking
  • Documentation
  • Communication
  • Customer service
  • Incident management
  • Team collaboration
  • Time management
  • Process adherence
  • Continuous learning mindset

Career Growth Opportunity

This position provides a structured career path toward Level 2 SOC Analyst, Senior SOC Analyst, Incident Responder, Threat Hunter, Security Engineer, Digital Forensics Analyst, or Security Architect. Analysts gain hands-on experience with enterprise security platforms, incident response methodologies, cloud security, threat intelligence, and modern cybersecurity operations.

Schedule

This position supports a 24×7 Security Operations Center (SOC). Candidates must be available for:
  • Scheduled day, evening, and overnight shifts
  • Weekend and holiday coverage
  • On-call rotation as required
  • Occasional overtime during significant security incidents

Benefits

Benefits include:
  • Medical insurance
  • Dental insurance
  • Vision insurance
  • 401(k)
  • Life insurance
  • Remote and hybrid work opportunities

    • About NOCDOC

    NOCDOC is a U.S.-based technology operations company with more than 35 years of experience delivering Security Operations Center (SOC), Network Operations Center (NOC), Service Desk, Network Engineering, Automation, and Managed Security Services.

    Supporting organizations across North America and internationally, NOCDOC delivers responsive, customer-focused technology operations that help businesses improve reliability, security, and operational efficiency.

    At NOCDOC, we invest in our people through continuous learning, mentorship, and career development, providing opportunities to grow into advanced engineering, automation, architecture, and technical leadership roles.