SOC Analyst

Get to Know Us Horizon3.ai is a fast-growing, remote cybersecurity company dedicated to the mission of enabling organizations to proactively find, fix and verify exploitable attack vectors before criminals exploit them. Our flagship product, the NodeZero™ platform, delivers production-safe autonomous pentests and other key assessment operations that scale across the largest internal, external, cloud, and hybrid cloud environments. NodeZero has been adopted by organizations of all sizes, from small educational institutions to government agencies and Global 100 enterprises. It is used by IT Ops/SecOps teams, consulting pentesters, and MSSPs and MSPs. We are a fusion of former U.S. Special Operations cyber operators, startup engineers & operators, and formerly frustrated cybersecurity practitioners. We're committed to helping solve our common security problems: ineffective security tools and false positives, resulting in alert fatigue, blind spots, “checkbox” security culture, cybersecurity skills shortage, and the long lead time and expense of hiring outside consultants. Collectively, we are a team of learn it alls, committed to a culture of respect, collaboration, ownership, and results. What You'll Do We are seeking a skilled SOC Analyst to join our growing Security Operations team. This is a mid-level role for an analyst who has developed strong foundational skills in Security Information and Event Management (SIEM) and is ready to take ownership of monitoring, triage, and detection work with minimal day-to-day direction. Working within one of our SOC shifts and reporting to the SOC Manager, you'll monitor the health and effectiveness of our SIEM platform (Elastic SIEM or equivalent) and support threat detection, log analytics, and incident response in a high-scale, cloud-native environment. As you grow, you'll take on more complex detections and investigations, contribute process improvements, and help onboard newer analysts. This role is instrumental in helping us scale and mature our security detection and response capabilities while maintaining a strong security posture across the organization. This role will be responsible for….. - Monitor, detect, and respond to security events across enterprise environments using the SIEM - Support log ingestion, parsing, and normalization, and monitor ingestion health across critical sources (AWS, Okta, endpoints, firewalls, SaaS), partnering with system owners to close telemetry gaps - Build and maintain dashboards, visualizations, and KPIs that demonstrate SIEM effectiveness and security visibility - Triage, investigate, and validate alerts, escalating confirmed or ambiguous incidents to a Senior Analyst or the SOC Manager with clear context - Tune and test detection rules (behavioral, heuristic, signature-based) to reduce false positives and improve fidelity - Use frameworks such as MITRE ATT&CK to contextualize detections and identify coverage gaps - Analyze logs across cloud, endpoint, network, and application sources to surface anomalies and potential threats - Perform structured investigations and root cause analysis, providing attack-chain mapping and remediation guidance for escalated alerts - Follow and help refine response playbooks for common incident types (phishing, suspicious logins, endpoint malware, privilege escalation, cloud misconfiguration), documenting lessons learned to strengthen detection logic - Contribute to SOAR automation (e.g., Tines or similar) to reduce manual toil and improve mean time to detect (MTTD) and respond (MTTR) - Use LLM/AI-assisted tooling to speed up triage, log summarization, and investigation enrichment, and contribute to SOC AI agent and automation workflows, verifying model output before acting on it - Participate in proactive threat hunting and contribute to weekly and monthly reporting on threat trends, false-positive reduction, and detection efficacy - Communicate clearly with shift peers and stakeholders, and, as you progress toward P3, help train and onboard more junior analysts - Demonstrate a commitment to integrity, process improvement, and customer satisfaction WHAT YOU'LL BRING - Must have hands-on SOC or security-analyst experience spanning SIEM monitoring, alert triage, detection tuning, and incident response - Must have working experience with an enterprise SIEM such as Elastic SIEM (preferred), Splunk, Microsoft Sentinel, QRadar, or similar - Must have a solid grasp of log analysis, security telemetry, and event correlation - Must have proficiency with detection-rule authoring and query languages (KQL, Lucene, SPL) and scripting in Python, Bash, or PowerShell - Must have familiarity with at least one major cloud (AWS, GCP, or Azure) and its security tooling - Must have working knowledge of MITRE ATT&CK, NIST, and CIS - Must have practical familiarity with using LLMs / AI assistants at work, including effective prompting, grounding responses in trusted data, and recognizing model limitations and when to verify output - Must have strong analytical and problem-solving skills, with the ability to prioritize and manage your own work with minimal direction - Must have clear written and verbal communication and the ability to document processes and findings MINIMUM EDUCATION AND EXPERIENCE - Bachelor's degree in Computer Science, Cybersecurity, Information Security, or a related field, or equivalent hands-on security operations experience - 3–6 years in a SOC or security analyst role - Demonstrated hands-on experience operating an enterprise SIEM (Elastic SIEM preferred) in a cloud environment Required Tech Stack Experience - SIEM platforms: Elastic SIEM (preferred), Splunk, Microsoft Sentinel, or QRadar - Query and detection languages: KQL, Lucene, or SPL - Scripting: Python, Bash, or PowerShell - Cloud platforms: AWS, GCP, and/or Azure - Security frameworks: MITRE ATT&CK, NIST, CIS - SOAR / automation platforms (e.g., Tines or similar) - Enterprise LLM / AI platforms (e.g., Claude, Gemini, AWS Bedrock, or similar) and prompt/agent tooling Work Authorization & Security Clearance Requirements Only US persons can interview for this role due to security clearance requirements by our customer(s) and/or vendor(s). Employee must be eligible for and successfully secure a US Federal Security Clearance as a condition of employment. What Sets You Apart? - Certifications such as Security+, CySA+, GCIA, GCIH, or Elastic Certified Analyst - Hands-on experience with endpoint detection and response (EDR) or XDR platforms - Judgment about which model fits which task, e.g., fast, lower-cost models for high-volume triage vs. stronger reasoning models for complex investigations, and how to prompt each for reliable results - Experience building agentic workflows that chain models, tools, and data sources (e.g., automated enrichment, triage, or investigation summarization) on an enterprise AI platform - Experience mentoring or onboarding junior analysts, or leading small process improvements end-to-end - Experience in a high-growth SaaS or cybersecurity company Travel Required We are a fully remote company, and this job may require up to 5% of travel to be successful. Compensation and Values At Horizon3, we believe that our people are our greatest asset, and our compensation philosophy reflects this core value. We are committed to fostering an environment where all employees feel valued, respected, and rewarded for their contributions. Our compensation structure is designed to be fair, competitive, and transparent, ensuring that every team member is recognized and compensated equitably across roles, levels, and locations. In accordance with various State's transparency regulations, we provide the following range information for this position: - Base salary range: $123,850 - $161,000 annually. The exact salary will be determined based on the selected candidate's location, qualifications, experience, and relevant skills. - Additional compensation: All full-time roles are eligible for an equity package in the form of stock options. Perks of Horizon3.ai http://Horizon3.ai - Inclusive Team: We value diversity and promote an inclusive culture where everyone can thrive. - Growth Opportunities: Be part of a dynamic and growing team with numerous career development opportunities. - Innovative Culture: Work in a collaborative environment that encourages creativity and out-of-the-box thinking. - Hybrid & Remote Work: We embrace a mix of remote and hybrid work models depending on role and location, including our Chicago office, where some roles require regular in-office presence. - Competitive Compensation: We offer competitive salary, equity and benefits. Our benefits include health, vision & dental insurance for you and your family, a flexible vacation policy, and generous parental leave. You Belong Here Horizon3 is not just an equal opportunity employer - we are a community that values diversity, equity, and inclusion as fundamental principles of our culture and success. We are dedicated to fostering a workplace where everyone feels welcome and respected, regardless of race, color, religion, sex, national origin, age, disability, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, hair length or any other legally protected status by law. Our commitment to diversity and inclusion means we strive to attract, develop, and retain a workforce that reflects the varied communities we serve. We believe that diverse perspectives drive innovation and strengthen our ability to create cutting-edge cybersecurity solutions. At Horizon3, every team member is valued and supported in an environment that encourages personal and professional growth. We welcome candidates from all backgrounds and experiences, and we encourage all qualified individuals to apply. Come be a part of Horizon3, where your unique contributions are recognized, and your potential is limitless. Other Duties Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee. Duties, responsibilities, and activities may change at any time with or without notice. Application Note In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.