Job Description

Job Description

Job Description

About the Role
Merci Technologies is seeking a SOC Analyst II to join a 24/7 security operations team supporting one of our enterprise clients. This is a hands-on, second-line role at the center of the client's detection and response program. You will spend your day investigating alerts that have escalated past the initial triage layer, separating real threats from noise, and driving confirmed incidents through containment and resolution. The environment is fast-moving and telemetry-rich, spanning cloud and on-premises systems, thousands of endpoints, and a modern security stack built around SIEM, EDR, and email security platforms.

Beyond day-to-day monitoring, this role carries real ownership. You will help mature the detection content the team relies on, reduce alert fatigue by tuning out false positives, and contribute to the runbooks and playbooks that keep response consistent across shifts. You will work shoulder to shoulder with senior analysts, threat hunters, and detection engineers, which makes this an excellent position for someone who wants to deepen their technical bench and grow toward a Tier 3 or specialized security engineering track. This is a fully remote position open to Full-Time or Contract candidates.

Key Responsibilities

• Monitor, triage, and investigate security alerts across SIEM, EDR, identity, and email security platforms
• Own Tier 2 investigation, containment, eradication, and escalation of confirmed security incidents
• Analyze logs, network traffic, endpoint telemetry, and user activity to identify indicators of compromise
• Conduct root cause analysis and document incidents, findings, and response actions per established runbooks
• Tune detection rules, suppress false positives, and recommend new detection logic in partnership with engineering
• Participate in proactive threat hunting based on current threat intelligence and emerging tactics
• Support and contribute to post-incident reviews, lessons learned, and continuous improvement of response playbooks
• Maintain shift handoff notes and ensure continuity of monitoring across a 24/7 coverage model

Required Qualifications

• 2 to 4 years of hands-on SOC, incident response, or security analyst experience
• Working knowledge of SIEM platforms such as Splunk, Microsoft Sentinel, or QRadar
• Familiarity with EDR tooling including CrowdStrike, SentinelOne, or Microsoft Defender
• Solid grounding in networking fundamentals, TCP/IP, DNS, and common attack techniques
• Ability to interpret logs and telemetry to reconstruct an attack timeline
• Strong written documentation and clear communication under time pressure

Preferred Qualifications

• Security+, CySA+, GCIH, or equivalent certification
• Experience with SOAR platforms and automation scripting in Python or PowerShell
• Working familiarity with the MITRE ATT&CK framework and threat-informed defense
• Exposure to cloud security monitoring in AWS or Azure

What You Will Bring
You are curious, methodical, and calm when alerts spike. You enjoy the investigative side of security, you ask good questions, and you document your work so the next analyst can pick up where you left off. You see tuning and automation not as extra work but as the way a strong SOC scales.

Job Tags

Similar Jobs