Senior Level SOC Analyst Jobs
Senior level soc analyst jobs put seasoned security professionals in charge of threat detection strategy, incident response leadership, and the analysts and processes that keep enterprise environments secure. Openings concentrate in Technology & Software, Consulting & Professional Services, and Education, with a mix of on-site, hybrid, and remote positions available, and employers like Charles River Associates, Adobe, and AMERICAN SYSTEMS hiring at this level now.
Find Senior Level SOC Analyst JobsOverview
Showing 5 of 37+ Senior Level SOC Analyst jobs
Title: Network Security Analyst 2
The primary work location(s) will be at Austin, TX 78751. The working position is On Site.
Job Summary
The Network Security Analyst II performs advanced cybersecurity and network security analysis work in support of HHSC’s enterprise security operations. This role is responsible for monitoring, detecting, investigating, and responding to security events across on-premises, cloud, and endpoint environments. The ideal candidate is a hands-on security operations professional with strong experience across SIEM, SOAR, EDR, network detection, and incident response platforms. This role requires sound judgment, technical depth, attention to detail, and a strong commitment to protecting HHSC systems, data, and services that support the health and well-being of Texans.
Essential Job Functions
- Monitor security alerts, logs, network events, endpoint telemetry, and threat intelligence feeds.
- Analyze suspicious activity, anomalous network behavior, malware indicators, endpoint detections, and SIEM correlation events to determine scope, impact, and required response actions.
- Perform incident triage, investigation, escalation, containment coordination, and documentation in alignment with HHSC security operations procedures.
- Develop, tune, and maintain detection rules, dashboards, alerts, playbooks, and queries to improve visibility across network, endpoint, identity, and cloud environments.
- Support threat hunting activities using KQL, SPL, packet/session analysis, endpoint telemetry, and other investigative techniques.
- Assist with vulnerability, risk, and control assessments for network security infrastructure and enterprise information systems.
- Document findings, prepare incident reports, track corrective actions, and communicate technical information to security leadership and business stakeholders.
- Collaborate with network, infrastructure, cloud, endpoint, and application teams to validate security events and implement risk mitigation measures.
- Maintain awareness of emerging cyber threats, attack techniques, indicators of compromise, and security best practices relevant to healthcare and public-sector environments.
- Support compliance, audit, and reporting activities by providing evidence, metrics, and security operations documentation as requested.
Required Qualifications
- Minimum of seven years of experience in cybersecurity, network security, security operations, incident response, or a closely related information security role.
- Hands-on experience with Microsoft Sentinel, including incident management, analytics rules, workbooks, automation, data connectors, and Kusto Query Language.
- Experience using SIEM for log analysis, alert investigation, dashboarding, correlation searches, and security monitoring.
- Experience with NDR for network traffic analysis, packet/session investigation, threat detection, and incident support.
- Experience with EDR tools, including endpoint alert triage, device investigation, advanced hunting, and response actions.
- Working knowledge of network security concepts, including firewalls, IDS/IPS, proxy logs, DNS, VPN, TCP/IP, segmentation, and secure network architecture.
- Ability to analyze complex security events, correlate data across multiple sources, and produce clear written documentation and recommendations.
- Knowledge of security frameworks, standards, and regulatory considerations such as NIST, CIS Controls, HIPAA, and state information security requirements.
- Strong communication, collaboration, problem-solving, and analytical skills.
Preferred Education and Certifications
- Bachelor’s degree in cybersecurity, computer science, information systems, information technology, or a related field. Relevant experience may be considered in place of education where applicable.
- Microsoft security certifications are strongly preferred, such as Microsoft Certified: Security Operations Analyst Associate, Microsoft Certified: Cybersecurity Architect Expert, Microsoft Certified: Azure Security Engineer Associate, or Microsoft 365 Defender-related certifications.
- Additional preferred certifications include CompTIA Security+, CySA+, GIAC security certifications, CISSP, CISM, CISA, Splunk Core Certified Power User, Splunk Enterprise Security Certified Admin, or SentinelOne product certifications.
Knowledge, Skills, and Abilities
- Knowledge of SIEM, SOAR, EDR, XDR, network detection and response, log management, and threat intelligence concepts.
- Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting.
- Skill in identifying indicators of compromise, attacker tactics, suspicious network patterns, and endpoint-based threats.
- Ability to prioritize alerts, document investigative steps, and escalate incidents based on severity and business impact.
- Ability to work independently and collaboratively in a security operations environment with shifting priorities and time-sensitive incidents.
- Ability to communicate cybersecurity risks, findings, and recommended actions to both technical and non-technical audiences.
Work Expectations
- Participate in incident response, escalation, and after-action review activities as needed.
- Support enterprise security monitoring for systems that process, store, or transmit sensitive information.
- Follow HHSC policies, procedures, standards, and applicable state and federal security requirements.
- Maintain accurate operational documentation, investigation notes, metrics, and leadership-ready summaries.
- May be required to provide support outside normal business hours during high-priority security incidents or planned maintenance activities.
Minimum Requirements:
Candidates that do not meet or exceed the minimum stated requirements (skills/experience) will be displayed to customers but may not be chosen for this opportunity.
Years Required/Preferred Experience
- 7 Required Knowledge of SIEM, SOAR, EDR, XDR, NDR
- 7 Required Experience with security log collection and management
- 7 Required Experience with threat intelligence concepts
- 7 Required Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting
- 7 Required Experience in SIEM platform/architecture support
- 7 Required Experience in detection engineering methodology and implementation
- 10 Preferred Knowledge of SIEM, SOAR, EDR, XDR, NDR
- 10 Preferred Experience with security log collection and management
- 10 Preferred Experience with threat intelligence concepts
- 10 Preferred Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting
- 10 Preferred Experience in SIEM platform/architecture support
- 10 Preferred Experience in detection engineering methodology and implementation
Title: Network Security Analyst 2
The primary work location(s) will be at Austin, TX 78751. The working position is On Site.
Job Summary
The Network Security Analyst II performs advanced cybersecurity and network security analysis work in support of HHSC’s enterprise security operations. This role is responsible for monitoring, detecting, investigating, and responding to security events across on-premises, cloud, and endpoint environments. The ideal candidate is a hands-on security operations professional with strong experience across SIEM, SOAR, EDR, network detection, and incident response platforms. This role requires sound judgment, technical depth, attention to detail, and a strong commitment to protecting HHSC systems, data, and services that support the health and well-being of Texans.
Essential Job Functions
- Monitor security alerts, logs, network events, endpoint telemetry, and threat intelligence feeds.
- Analyze suspicious activity, anomalous network behavior, malware indicators, endpoint detections, and SIEM correlation events to determine scope, impact, and required response actions.
- Perform incident triage, investigation, escalation, containment coordination, and documentation in alignment with HHSC security operations procedures.
- Develop, tune, and maintain detection rules, dashboards, alerts, playbooks, and queries to improve visibility across network, endpoint, identity, and cloud environments.
- Support threat hunting activities using KQL, SPL, packet/session analysis, endpoint telemetry, and other investigative techniques.
- Assist with vulnerability, risk, and control assessments for network security infrastructure and enterprise information systems.
- Document findings, prepare incident reports, track corrective actions, and communicate technical information to security leadership and business stakeholders.
- Collaborate with network, infrastructure, cloud, endpoint, and application teams to validate security events and implement risk mitigation measures.
- Maintain awareness of emerging cyber threats, attack techniques, indicators of compromise, and security best practices relevant to healthcare and public-sector environments.
- Support compliance, audit, and reporting activities by providing evidence, metrics, and security operations documentation as requested.
Required Qualifications
- Minimum of seven years of experience in cybersecurity, network security, security operations, incident response, or a closely related information security role.
- Hands-on experience with Microsoft Sentinel, including incident management, analytics rules, workbooks, automation, data connectors, and Kusto Query Language.
- Experience using SIEM for log analysis, alert investigation, dashboarding, correlation searches, and security monitoring.
- Experience with NDR for network traffic analysis, packet/session investigation, threat detection, and incident support.
- Experience with EDR tools, including endpoint alert triage, device investigation, advanced hunting, and response actions.
- Working knowledge of network security concepts, including firewalls, IDS/IPS, proxy logs, DNS, VPN, TCP/IP, segmentation, and secure network architecture.
- Ability to analyze complex security events, correlate data across multiple sources, and produce clear written documentation and recommendations.
- Knowledge of security frameworks, standards, and regulatory considerations such as NIST, CIS Controls, HIPAA, and state information security requirements.
- Strong communication, collaboration, problem-solving, and analytical skills.
Preferred Education and Certifications
- Bachelor’s degree in cybersecurity, computer science, information systems, information technology, or a related field. Relevant experience may be considered in place of education where applicable.
- Microsoft security certifications are strongly preferred, such as Microsoft Certified: Security Operations Analyst Associate, Microsoft Certified: Cybersecurity Architect Expert, Microsoft Certified: Azure Security Engineer Associate, or Microsoft 365 Defender-related certifications.
- Additional preferred certifications include CompTIA Security+, CySA+, GIAC security certifications, CISSP, CISM, CISA, Splunk Core Certified Power User, Splunk Enterprise Security Certified Admin, or SentinelOne product certifications.
Knowledge, Skills, and Abilities
- Knowledge of SIEM, SOAR, EDR, XDR, network detection and response, log management, and threat intelligence concepts.
- Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting.
- Skill in identifying indicators of compromise, attacker tactics, suspicious network patterns, and endpoint-based threats.
- Ability to prioritize alerts, document investigative steps, and escalate incidents based on severity and business impact.
- Ability to work independently and collaboratively in a security operations environment with shifting priorities and time-sensitive incidents.
- Ability to communicate cybersecurity risks, findings, and recommended actions to both technical and non-technical audiences.
Work Expectations
- Participate in incident response, escalation, and after-action review activities as needed.
- Support enterprise security monitoring for systems that process, store, or transmit sensitive information.
- Follow HHSC policies, procedures, standards, and applicable state and federal security requirements.
- Maintain accurate operational documentation, investigation notes, metrics, and leadership-ready summaries.
- May be required to provide support outside normal business hours during high-priority security incidents or planned maintenance activities.
Minimum Requirements:
Candidates that do not meet or exceed the minimum stated requirements (skills/experience) will be displayed to customers but may not be chosen for this opportunity.
Years Required/Preferred Experience
- 7 Required Knowledge of SIEM, SOAR, EDR, XDR, NDR
- 7 Required Experience with security log collection and management
- 7 Required Experience with threat intelligence concepts
- 7 Required Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting
- 7 Required Experience in SIEM platform/architecture support
- 7 Required Experience in detection engineering methodology and implementation
- 10 Preferred Knowledge of SIEM, SOAR, EDR, XDR, NDR
- 10 Preferred Experience with security log collection and management
- 10 Preferred Experience with threat intelligence concepts
- 10 Preferred Skill in writing and interpreting KQL, SPL, and security queries to support investigations and reporting
- 10 Preferred Experience in SIEM platform/architecture support
- 10 Preferred Experience in detection engineering methodology and implementation
See All 37 Senior Level SOC Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Senior Level SOC Analyst JobsSenior Level SOC Analyst Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Consulting & Professional Services
- Education
- Aerospace & Defense
- Healthcare & Medical Services
Senior Level SOC Analyst Jobs: Frequently Asked Questions
How do I get a senior level soc analyst job?
Employers hiring at the senior level want candidates who have led incident response efforts, mentored junior analysts, and owned detection engineering or threat hunting programs. Hands-on experience with SIEM platforms, EDR tooling, and cloud security is expected, not a differentiator. What sets candidates apart at this stage is demonstrated ownership of outcomes, the ability to build or improve SOC processes, and a history of cross-functional collaboration with engineering and leadership teams.
Which companies hire senior level soc analysts?
Companies hiring senior level soc analysts right now include Charles River Associates, Adobe, and AMERICAN SYSTEMS, based on current listings on Migrate Mate as of September 2026. Hiring at this level comes primarily from large enterprises, managed security service providers, financial institutions, defense contractors, and technology companies with mature security operations programs.
Are there remote senior level soc analyst jobs?
Yes, though availability varies by employer and the sensitivity of the work involved. About 40% of senior level soc analyst openings are remote or hybrid as of September 2026, reflecting strong demand for experienced analysts who can operate independently without on-site supervision. Roles tied to classified environments or high-compliance industries tend to require more in-person presence.
What makes a soc analyst role senior level?
Senior level soc analyst roles are defined by scope, ownership, and leadership responsibility. Rather than executing tasks assigned by others, senior analysts design detection logic, lead complex incident investigations, set response playbooks, and mentor junior and mid-level team members. They are expected to identify gaps in coverage, recommend tooling improvements, and communicate risk clearly to stakeholders outside the security team.
Which industries hire the most senior level soc analysts?
Senior level soc analyst roles concentrate in Technology & Software, Consulting & Professional Services, and Education, based on current listings on Migrate Mate as of September 2026. These sectors drive hiring at this level because they operate at scale with complex regulatory requirements, high-value data environments, and mature security programs that need experienced practitioners to lead day-to-day operations.