Security Operations Analyst

• Triage, investigate, and respond to alerts from the Huntress platform
• Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine attack root cause and provide remediations
• Perform tactical malware analysis while investigating and triaging alerts
• Investigate suspicious Microsoft M365 activity and provide remediations
• Assist Product Support escalations for threat-related and SOC-relevant questions
• Contribute to detection engineering creation and tuning
• Contribute to projects improving outcomes for analysts and partners
• Contribute to the collaboratively mentored team

• 2+ years experience in a SOC or Digital Forensics (DFIR) role
• Demonstrated experience with Windows, Linux, and MacOS as an attack surface
• Demonstrated experience with basic Threat Actor tools and techniques, including MITRE ATT&CK Framework, PowerShell, Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, and other offensive/Red Team TTPs
• Demonstrated experience with static and dynamic malware analysis concepts
• Working knowledge of Windows Administration or Enterprise Domain Administration, including Active Directory, Group Policy, and Domain Trusts
• Working knowledge of core networking concepts, including common ports/protocols, NAT, Public/Private IPs, and VLANs
• Working knowledge of web technologies and concepts, including web servers/applications and OWASP top 10
• Effective communication skills, with the ability to explain complex events to less technical audiences
• Dedicated to prioritizing and addressing customer needs and concerns
• Strong sense of curiosity and genuine excitement for learning
• Previous experience in an MSP/MSSP/MDR role (preferred)
• Linux and MacOS investigative experience (preferred)
• Experience with scripting languages such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby (preferred)
• Demonstrated experience on HackTheBox, TryHackMe, Blue Team Labs Online, or similar platforms (preferred)
• Demonstrated experience with cloud-based investigations such as M365, Azure, AWS, or GCP (preferred)
• Participation in cybersecurity competitions such as Capture the Flags or Collegiate Cyber Defense Competition (preferred)
• Familiarity with MSP tools such as RMMs (preferred)

• 100% remote work environment
• New starter home office set up reimbursement (£398)
• Generous personal leave entitlements
• Digital monthly reimbursement (£92)
• Travel to the US 1-2 times/year for various company events
• Pension
• Access to the BetterUp platform for coaching, personal, and professional growth