Security Operations Center Analyst Jobs
Security Operations Center Analyst jobs are open across defense, finance, healthcare, and technology, from entry-level tier-one roles to senior analyst and SOC lead positions, with specializations in threat detection, incident response, and SIEM management. Find a role that fits from the openings below and apply directly.
Find JobsOverview
Showing 5 of 49+ Security Operations Center Analyst jobs
The Security Operations Center Analyst is responsible for the administration, support, optimization, and expansion of the organization's security monitoring and log management platforms, including Splunk and Cribl. This role serves as a key contributor to security operations by ensuring reliable collection, processing, and analysis of security telemetry across both IT and Operational Technology (OT) environments.
Role provides the opportunity to work in a hybrid environment, working both virtually and in the Houston office when required.
REQUIRED
Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, Engineering, or related field, or equivalent experience.
Minimum 3 years of experience supporting security monitoring, SIEM, or security engineering platforms.
Minimum 1 years’ experience administering Splunk Enterprise.
Minimum 1 years’ experience supporting Cribl or similar log management technologies.
Minimum 1 years’ experience with Syslog architecture and log ingestion technologies.
Minimum 1 years’ experience supporting Managed Detection and Response (MDR) services or Security Operations Centers.
Minimum 1 years’ experience working with Windows, Linux, network, and cloud log sources.
Familiarity with Operational Technology (OT) and Industrial Control System (ICS) environments.
DESIRED
Splunk Certified Administrator or Splunk Certified Architect certification.
Experience with industrial networking and OT/ICS environments.
Experience integrating enterprise logging platforms with MDR providers.
Knowledge of NIST Cybersecurity Framework, IEC 62443, or ISA/IEC industrial security standards.
Experience with scripting and automation using PowerShell, Python, or similar tools.
Familiarity with Microsoft Azure and cloud security monitoring.
Functions
The position is responsible for supporting the integration and ongoing operation of the Managed Detection and Response (MDR) Security Operations Center (SOC), enabling effective threat detection, incident investigation, and security monitoring capabilities.
Additionally, the role designs, implements, and maintains secure log forwarding infrastructure, including Syslog collectors and forwarders within the OT DMZ (Level 3.5) of the Purdue Model, ensuring visibility into critical industrial control system environments while maintaining required segmentation and security controls.
Splunk Administration & Engineering
Administer and maintain Splunk infrastructure, including search heads, indexers, forwarders, and supporting services.
Configure and optimize data ingestion, indexing, retention, and storage management.
Troubleshoot platform issues and coordinate remediation activities.
Develop and maintain Splunk dashboards, alerts, reports, and operational monitoring content.
Ensure system availability, performance, scalability, and compliance with organizational requirements.
Coordinate upgrades, patching, and lifecycle management activities.
Cribl Administration & Engineering
Administer and support Cribl Stream infrastructure and associated log pipelines.
Develop and maintain log routing, filtering, enrichment, masking, and normalization workflows.
Optimize data collection to improve security visibility while controlling storage and licensing costs.
Monitor and troubleshooting of ingestion issues across multiple log sources.
Collaborate with infrastructure, network, and security teams to onboard new data sources
MDR SOC Integration & Operations
Support deployment and integration activities associated with the managed security operations center (MDR SOC).
Coordinate onboarding of log sources and security telemetry required for threat monitoring.
Partner with MDR analysts to improve detection coverage and data quality.
Validate alerting, event correlation, and incident workflows.
Assist with tuning security use cases to reduce false positives and improve operational effectiveness.
Participate in ongoing operational reviews and continuous improvement activities.
OT Security Monitoring & Syslog Infrastructure
Design, implement, and support Syslog forwarding architecture within OT environments.
Deploy and maintain log collectors and forwarders within the Level 3.5 OT DMZ in accordance with the Purdue Model.
Work with OT, Infrastructure, and Network teams to onboard industrial and manufacturing systems into enterprise monitoring platforms.
Ensure security monitoring solutions align with OT segmentation and regulatory requirements.
Troubleshoot connectivity, log collection, and data quality issues across OT environments.
Support secure transmission and retention of OT security events.
Security Operations Support
Investigate platform-generated alerts and assist with security incident response activities.
Validate integrity and availability of security monitoring infrastructure.
Support audit, compliance, and regulatory reporting requirements.
Maintain engineering documentation, architecture diagrams, and operational procedures.
Participate in after-hours support activities when required.
The Security Operations Center Analyst is responsible for the administration, support, optimization, and expansion of the organization's security monitoring and log management platforms, including Splunk and Cribl. This role serves as a key contributor to security operations by ensuring reliable collection, processing, and analysis of security telemetry across both IT and Operational Technology (OT) environments.
Role provides the opportunity to work in a hybrid environment, working both virtually and in the Houston office when required.
REQUIRED
Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, Engineering, or related field, or equivalent experience.
Minimum 3 years of experience supporting security monitoring, SIEM, or security engineering platforms.
Minimum 1 years’ experience administering Splunk Enterprise.
Minimum 1 years’ experience supporting Cribl or similar log management technologies.
Minimum 1 years’ experience with Syslog architecture and log ingestion technologies.
Minimum 1 years’ experience supporting Managed Detection and Response (MDR) services or Security Operations Centers.
Minimum 1 years’ experience working with Windows, Linux, network, and cloud log sources.
Familiarity with Operational Technology (OT) and Industrial Control System (ICS) environments.
DESIRED
Splunk Certified Administrator or Splunk Certified Architect certification.
Experience with industrial networking and OT/ICS environments.
Experience integrating enterprise logging platforms with MDR providers.
Knowledge of NIST Cybersecurity Framework, IEC 62443, or ISA/IEC industrial security standards.
Experience with scripting and automation using PowerShell, Python, or similar tools.
Familiarity with Microsoft Azure and cloud security monitoring.
Functions
The position is responsible for supporting the integration and ongoing operation of the Managed Detection and Response (MDR) Security Operations Center (SOC), enabling effective threat detection, incident investigation, and security monitoring capabilities.
Additionally, the role designs, implements, and maintains secure log forwarding infrastructure, including Syslog collectors and forwarders within the OT DMZ (Level 3.5) of the Purdue Model, ensuring visibility into critical industrial control system environments while maintaining required segmentation and security controls.
Splunk Administration & Engineering
Administer and maintain Splunk infrastructure, including search heads, indexers, forwarders, and supporting services.
Configure and optimize data ingestion, indexing, retention, and storage management.
Troubleshoot platform issues and coordinate remediation activities.
Develop and maintain Splunk dashboards, alerts, reports, and operational monitoring content.
Ensure system availability, performance, scalability, and compliance with organizational requirements.
Coordinate upgrades, patching, and lifecycle management activities.
Cribl Administration & Engineering
Administer and support Cribl Stream infrastructure and associated log pipelines.
Develop and maintain log routing, filtering, enrichment, masking, and normalization workflows.
Optimize data collection to improve security visibility while controlling storage and licensing costs.
Monitor and troubleshooting of ingestion issues across multiple log sources.
Collaborate with infrastructure, network, and security teams to onboard new data sources
MDR SOC Integration & Operations
Support deployment and integration activities associated with the managed security operations center (MDR SOC).
Coordinate onboarding of log sources and security telemetry required for threat monitoring.
Partner with MDR analysts to improve detection coverage and data quality.
Validate alerting, event correlation, and incident workflows.
Assist with tuning security use cases to reduce false positives and improve operational effectiveness.
Participate in ongoing operational reviews and continuous improvement activities.
OT Security Monitoring & Syslog Infrastructure
Design, implement, and support Syslog forwarding architecture within OT environments.
Deploy and maintain log collectors and forwarders within the Level 3.5 OT DMZ in accordance with the Purdue Model.
Work with OT, Infrastructure, and Network teams to onboard industrial and manufacturing systems into enterprise monitoring platforms.
Ensure security monitoring solutions align with OT segmentation and regulatory requirements.
Troubleshoot connectivity, log collection, and data quality issues across OT environments.
Support secure transmission and retention of OT security events.
Security Operations Support
Investigate platform-generated alerts and assist with security incident response activities.
Validate integrity and availability of security monitoring infrastructure.
Support audit, compliance, and regulatory reporting requirements.
Maintain engineering documentation, architecture diagrams, and operational procedures.
Participate in after-hours support activities when required.
Security Operations Center Analyst Jobs by Experience Level
See All 49 Security Operations Center Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsSecurity Operations Center Analyst Job Market
Who's Hiring
- CENCORE11
- Metro One LPSG8
- CEVA Logistics2
- Chenega Corporation2
- COCC1
Top Industries Hiring
- Consulting & Professional Services
- Food & Beverage
- News & Publishing
- Aerospace & Defense
- Electronics & Hardware
What Employers Look For
The qualifications that appear most often in security operations center analyst jobs.
- 1-3 years of hands-on experience in a security operations or incident response environment
- Proficiency with SIEM platforms such as Splunk, Microsoft Sentinel, or IBM QRadar
- CompTIA Security+ or CySA+ certification, or equivalent industry credential
- Ability to analyze network traffic, system logs, and endpoint telemetry for indicators of compromise
- Familiarity with frameworks including MITRE ATT&CK, NIST, and the Cyber Kill Chain
- Bachelor's degree in cybersecurity, information technology, computer science, or a related field
Tips for Your Security Operations Center Analyst Job Search
Tailor your resume to SOC tiers
SOC analyst postings almost always specify tier level. Align your resume to the tier you're targeting by leading with the tools and alert-triage responsibilities that match that level, not a generic cybersecurity summary.
Certify before you apply for senior roles
CompTIA CySA+, Security+, and CEH show up in the majority of mid-to-senior SOC postings. If you're targeting those levels without one, your application is likely filtered before a human reviews it.
Apply early to roles that fit
Migrate Mate lists security operations center analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Highlight specific SIEM platforms by name
Hiring managers scan for Splunk, Microsoft Sentinel, IBM QRadar, or Elastic SIEM by name. List every platform you have hands-on experience with in a dedicated tools section so it registers in both ATS scans and recruiter reviews.
Prepare for a technical screening scenario
SOC interviews routinely include a live log analysis or simulated alert triage. Before your interview, practice walking through an incident timeline out loud, covering detection, containment, and escalation steps in sequence.
Negotiate shift differential and on-call terms
Many SOC roles run 24/7 operations with rotating shifts or on-call obligations. Before accepting an offer, clarify the rotation schedule and whether overnight or weekend shifts carry additional compensation.
Security Operations Center Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most security operations center analysts?
The companies hiring the most security operations center analysts right now include CENCORE, Metro One LPSG, and CEVA Logistics, with the largest share of openings in Texas, Ohio, and Hawaii, based on current listings on Migrate Mate as of August 2026. Defense contractors, large financial institutions, and managed security service providers consistently account for the highest volume of postings.
How many security operations center analyst jobs are remote?
About 46% of security operations center analyst openings are fully remote or hybrid as of August 2026, though many roles in government and cleared defense environments require on-site presence. Threat intelligence, SIEM engineering, and tier-one triage functions tend to have the highest remote availability within the SOC career track.
How do you become a security operations center analyst?
Start with a foundation in networking and operating systems, then pursue an entry-level certification such as CompTIA Security+. Build hands-on experience through a home lab, a helpdesk or IT support role, or an internship with a security team. Apply to tier-one SOC positions and work toward CySA+ or a SIEM-specific credential as you gain alert-handling experience on the job.
Can you get a security operations center analyst job with no experience?
Yes, tier-one SOC analyst roles are specifically designed as entry points and many employers will hire candidates without prior security operations experience if you hold CompTIA Security+ and can demonstrate familiarity with log analysis and alert triage. A home lab running a free SIEM instance, a capstone project from a cybersecurity bootcamp, or relevant coursework often substitutes for direct work history at the entry level.
What does the security operations center analyst interview process look like?
Most SOC analyst hiring processes begin with a recruiter screen followed by a technical phone interview covering networking fundamentals, common attack types, and SIEM tool knowledge. A live or take-home scenario then asks you to analyze a set of logs or walk through an incident response sequence. Final rounds typically involve a panel with senior analysts or a SOC manager who assesses your escalation judgment and communication under pressure.
Where can I find and apply to security operations center analyst jobs?
You can find and apply to security operations center analyst jobs on Migrate Mate, which lists current openings from across the United States. Search the available roles, find the ones that match your experience and target tier, and apply directly to each listing.
See All 49 Security Operations Center Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs