SOC Analyst (Level 3)
Compensation: $65-68/hr
Shift: 2:00 PM to 10:30 PM EST 
Location: Greensboro, NC 2-3 days onsite

Our long-standing client, one of the largest automobile and equipment manufacturers in the world, has been steadily growing for almost 100 years. With over 100,000 employees in 18 countries, this $47B company has a worldwide reputation for being an excellent company to work for. Having supported various teams with long-tenured employees, the organization has a history of low turnover, offering an impressive benefits package, great work-life balance, and promotional opportunities to grow with a multinational leader.

Position Overview
As a Senior Cyber Defense Incident Responder, you will play a critical role in protecting CRG's clients' global infrastructure. In this hands-on technical position, you’ll manage and respond to advanced cyber threats, lead complex investigations, and help shape our security posture through continuous improvement. You’ll also mentor junior analysts, foster knowledge sharing, and collaborate cross-functionally to strengthen our overall threat detection and response capabilities.

---

What You’ll Do

• Lead the analysis and response for complex security incidents and alerts using SOC tools such as SIEM, EDR, and IDS/IPS.
• Investigate escalated incidents from Level 1 and Level 2 analysts, ensuring swift containment, eradication, and recovery.
• Conduct end-to-end investigations of cybersecurity incidents, including malware outbreaks, data breaches, insider threats, and targeted intrusions.
• Perform digital forensics, preserving and analyzing evidence in support of legal, compliance, and regulatory requirements.
• Produce detailed incident reports with root cause analysis, lessons learned, and actionable remediation steps.
• Leverage threat intelligence to identify indicators of compromise (IOCs) and apply them to strengthen detection and prevention.
• Guide, mentor, and train junior SOC analysts, promoting skill development and a collaborative team culture.
• Partner with IT, security engineering, and business stakeholders to improve security controls and processes.
• Continuously assess SOC tools, workflows, and detection capabilities, recommending enhancements to increase efficiency and resilience.
• Identify gaps in threat detection and response, and help define requirements for new tools, signatures, or processes.

---

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or a related technical discipline.
• 7+ years of experience supporting cyber defense operations in complex enterprise environments.
• Proven track record in SOC, SIRT, or CSIRT roles managing high-severity incidents.
• One or more relevant certifications (e.g., GCIH, GCIA, CISSP, GIAC Certified Intrusion Analyst).
• Deep expertise in threat actor tactics, techniques, and procedures (TTPs), including APT, cybercrime, and hacktivist campaigns.
• Advanced knowledge of cybersecurity frameworks and methodologies such as the Cyber Kill Chain, MITRE ATT&CK, NIST, and SANS CSC.
• Proficiency in digital forensics, malware analysis, and evidence preservation.
• Strong understanding of Windows, Linux, and MacOS operating systems, as well as core network and application protocols.
• Hands-on scripting experience (e.g., PowerShell, Python, Perl) to automate investigative tasks.
• Experience tuning and managing SIEM rules, IDS/IPS signatures, EDR platforms, and other security controls.
• Familiarity with modern cryptography, authentication, and authorization mechanisms.
• Strong analytical and problem-solving skills with the ability to distinguish true positives from false positives quickly.
• Ability to write clear technical documentation, stakeholder updates, and executive-level briefings.

---

Preferred Qualifications

• Experience leading initiatives in a large, global Cybersecurity Operations Center.
• Proven background in intelligence-driven detection, threat hunting, OT security, and advanced threat modeling.
• Process management experience within SOC environments, including playbook development and continuous improvement initiatives.
• Certifications such as Linux+, CCNA, CCNP, or additional GIAC credentials are highly desirable.
• Strong ability to translate complex technical concepts into clear communication for business leaders, stakeholders, and technical teams.
• Knowledge of vulnerability management practices and secure network design principles.

Category Code: JN008
#LI-AK1