Senior Level SOC Analyst Jobs
Senior level soc analyst jobs put seasoned security professionals in charge of threat detection strategy, incident response leadership, and the analysts and processes that keep enterprise environments secure. Openings concentrate in Technology & Software, Education, and Healthcare & Medical Services, with a mix of on-site, hybrid, and remote positions available, and employers like EY, Okta, and Xylem hiring at this level now.
Find Senior Level SOC Analyst JobsOverview
Showing 5 of 20+ Senior Level SOC Analyst jobs
Job Description
Workday Job Profile: Principal Security Engineer
Business/Posting Title: Principal Security Engineer, Incident Response
Grade: 11
Job Summary:
The Principal Security Engineer, Incident Response is a senior technical cybersecurity role responsible for leading the investigation, containment, eradication, and recovery of security incidents across Advance Auto Parts’ enterprise environment.
Reporting to the Sr. Manager, Cybersecurity Incident Response, this role serves as a technical lead and escalation point within the Incident Response (IR) program. The role is responsible for ensuring incidents are rapidly triaged, thoroughly investigated, and fully remediate while minimizing risk to business operations, customers, team members, and company reputation.
The Senior Incident Responder will partner across Cybersecurity, Technology, Legal, Privacy, Risk Management, Store Operations, and Supply Chain Operations to resolve complex security events and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches.
What will you do?
Incident Response & Investigations
- Lead technical response to high-severity cybersecurity incidents from detection through closure.
- Serve as technical lead and deputy to the Incident Commander during major cybersecurity events.
- Investigate and respond to ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
- Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
- Execute containment, eradication, and recovery actions in coordination with Technology and business teams.
- Preserve evidence and maintain chain of custody in support of legal, regulatory, privacy, and cyber insurance requirements.
- Serve as the escalation point for junior incident responders on complex or ambiguous security events.
- Produce clear, timely incident documentation, technical findings, and status updates for leadership.
Threat Hunting & Detection
- Conduct proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
- Translate incident findings into new or improved detections aligned to MITRE ATT&CK.
- Partner with Engineering teams to tune monitoring technologies and improve signal-to-noise ratios.
- Leverage threat intelligence to enrich investigations and anticipate threat actor TTPs targeting the retail industry.
- Identify opportunities to automate triage, enrichment, and response actions.
Cyber Preparedness & Resilience
- Develop, maintain, and test incident response playbooks so they remain current and actionable.
- Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
- Lead post-incident reviews and track corrective actions through completion.
- Contribute incident data to operational metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
Collaboration & Mentorship
- Mentor and develop junior incident responders through case reviews and hands-on coaching.
- Share knowledge through runbooks, training sessions, and lessons learned.
- Coordinate with external IR retainers, forensic vendors, and law enforcement as directed.
- Model a culture of accountability, resilience, and continuous improvement.
Location & Work Availability:
This position is Hybrid (4 days in office, 1 day remote), based at our corporate headquarters in Raleigh, North Carolina.
Qualifications:
- 6+ years of experience in cybersecurity, with at least 3 years focused on incident response, digital forensics, or threat hunting.
- Proven experience leading investigations of ransomware, business email compromise, cloud, and identity-based attacks.
- Hands-on expertise with security technologies (SIEM, SOAR, EDR, cloud security tools, network and forensic analysis tools).
- Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms (AWS, Azure, or GCP).
- Experience with cybersecurity frameworks (NIST SP 800-61, NIST CSF, MITRE ATT&CK).
- Scripting ability (Python, PowerShell, or similar) to support investigations and automation.
- Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
Preferred Qualifications
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
- Experience in large-scale, complex organizations, retail, or highly regulated industries.
- Expertise in cybersecurity automation and analytics.
Certifications, Experience, and Education:
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
Benefits Summary:
We believe in supporting our Team Members and those they love through comprehensive health & wellness benefits. Learn more here: https://jobs.advanceautoparts.com/us/en/benefits
Company Overview:
Advance Auto Parts, Inc. is a leading automotive aftermarket parts provider that serves both professional installer and do-it-yourself customers. As of January 3, 2026, Advance operated 4,305 stores primarily within the United States, with additional locations in Canada, Puerto Rico and the U.S. Virgin Islands. The Company also served 809 independently owned Carquest branded stores across these locations in addition to Mexico and various Caribbean islands. Additional information about Advance, including employment opportunities, customer services, and online shopping for parts, accessories and other offerings can be found at www.AdvanceAutoParts.com.
We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age national origin, religion, sexual orientation, gender identity, status as a veteran and basis of disability or any other federal, state, or local protected class.
California Residents click below for Privacy Notice:
https://jobs.advanceautoparts.com/us/en/disclosures
Job Description
Workday Job Profile: Principal Security Engineer
Business/Posting Title: Principal Security Engineer, Incident Response
Grade: 11
Job Summary:
The Principal Security Engineer, Incident Response is a senior technical cybersecurity role responsible for leading the investigation, containment, eradication, and recovery of security incidents across Advance Auto Parts’ enterprise environment.
Reporting to the Sr. Manager, Cybersecurity Incident Response, this role serves as a technical lead and escalation point within the Incident Response (IR) program. The role is responsible for ensuring incidents are rapidly triaged, thoroughly investigated, and fully remediate while minimizing risk to business operations, customers, team members, and company reputation.
The Senior Incident Responder will partner across Cybersecurity, Technology, Legal, Privacy, Risk Management, Store Operations, and Supply Chain Operations to resolve complex security events and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches.
What will you do?
Incident Response & Investigations
- Lead technical response to high-severity cybersecurity incidents from detection through closure.
- Serve as technical lead and deputy to the Incident Commander during major cybersecurity events.
- Investigate and respond to ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
- Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
- Execute containment, eradication, and recovery actions in coordination with Technology and business teams.
- Preserve evidence and maintain chain of custody in support of legal, regulatory, privacy, and cyber insurance requirements.
- Serve as the escalation point for junior incident responders on complex or ambiguous security events.
- Produce clear, timely incident documentation, technical findings, and status updates for leadership.
Threat Hunting & Detection
- Conduct proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
- Translate incident findings into new or improved detections aligned to MITRE ATT&CK.
- Partner with Engineering teams to tune monitoring technologies and improve signal-to-noise ratios.
- Leverage threat intelligence to enrich investigations and anticipate threat actor TTPs targeting the retail industry.
- Identify opportunities to automate triage, enrichment, and response actions.
Cyber Preparedness & Resilience
- Develop, maintain, and test incident response playbooks so they remain current and actionable.
- Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
- Lead post-incident reviews and track corrective actions through completion.
- Contribute incident data to operational metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
Collaboration & Mentorship
- Mentor and develop junior incident responders through case reviews and hands-on coaching.
- Share knowledge through runbooks, training sessions, and lessons learned.
- Coordinate with external IR retainers, forensic vendors, and law enforcement as directed.
- Model a culture of accountability, resilience, and continuous improvement.
Location & Work Availability:
This position is Hybrid (4 days in office, 1 day remote), based at our corporate headquarters in Raleigh, North Carolina.
Qualifications:
- 6+ years of experience in cybersecurity, with at least 3 years focused on incident response, digital forensics, or threat hunting.
- Proven experience leading investigations of ransomware, business email compromise, cloud, and identity-based attacks.
- Hands-on expertise with security technologies (SIEM, SOAR, EDR, cloud security tools, network and forensic analysis tools).
- Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms (AWS, Azure, or GCP).
- Experience with cybersecurity frameworks (NIST SP 800-61, NIST CSF, MITRE ATT&CK).
- Scripting ability (Python, PowerShell, or similar) to support investigations and automation.
- Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
Preferred Qualifications
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
- Experience in large-scale, complex organizations, retail, or highly regulated industries.
- Expertise in cybersecurity automation and analytics.
Certifications, Experience, and Education:
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
Benefits Summary:
We believe in supporting our Team Members and those they love through comprehensive health & wellness benefits. Learn more here: https://jobs.advanceautoparts.com/us/en/benefits
Company Overview:
Advance Auto Parts, Inc. is a leading automotive aftermarket parts provider that serves both professional installer and do-it-yourself customers. As of January 3, 2026, Advance operated 4,305 stores primarily within the United States, with additional locations in Canada, Puerto Rico and the U.S. Virgin Islands. The Company also served 809 independently owned Carquest branded stores across these locations in addition to Mexico and various Caribbean islands. Additional information about Advance, including employment opportunities, customer services, and online shopping for parts, accessories and other offerings can be found at www.AdvanceAutoParts.com.
We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age national origin, religion, sexual orientation, gender identity, status as a veteran and basis of disability or any other federal, state, or local protected class.
California Residents click below for Privacy Notice:
https://jobs.advanceautoparts.com/us/en/disclosures
See All 20 Senior Level SOC Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Senior Level SOC Analyst JobsSenior Level SOC Analyst Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Education
- Healthcare & Medical Services
- Investment & Asset Management
- Insurance
Senior Level SOC Analyst Jobs: Frequently Asked Questions
How do I get a senior level soc analyst job?
Employers hiring at the senior level want candidates who have led incident response efforts, mentored junior analysts, and owned detection engineering or threat hunting programs. Hands-on experience with SIEM platforms, EDR tooling, and cloud security is expected, not a differentiator. What sets candidates apart at this stage is demonstrated ownership of outcomes, the ability to build or improve SOC processes, and a history of cross-functional collaboration with engineering and leadership teams.
Which companies hire senior level soc analysts?
Companies hiring senior level soc analysts right now include EY, Okta, and Xylem, based on current listings on Migrate Mate as of November 2026. Hiring at this level comes primarily from large enterprises, managed security service providers, financial institutions, defense contractors, and technology companies with mature security operations programs.
Are there remote senior level soc analyst jobs?
Yes, though availability varies by employer and the sensitivity of the work involved. About 47% of senior level soc analyst openings are remote or hybrid as of November 2026, reflecting strong demand for experienced analysts who can operate independently without on-site supervision. Roles tied to classified environments or high-compliance industries tend to require more in-person presence.
What makes a soc analyst role senior level?
Senior level soc analyst roles are defined by scope, ownership, and leadership responsibility. Rather than executing tasks assigned by others, senior analysts design detection logic, lead complex incident investigations, set response playbooks, and mentor junior and mid-level team members. They are expected to identify gaps in coverage, recommend tooling improvements, and communicate risk clearly to stakeholders outside the security team.
Which industries hire the most senior level soc analysts?
Senior level soc analyst roles concentrate in Technology & Software, Education, and Healthcare & Medical Services, based on current listings on Migrate Mate as of November 2026. These sectors drive hiring at this level because they operate at scale with complex regulatory requirements, high-value data environments, and mature security programs that need experienced practitioners to lead day-to-day operations.