SOC Incident Responder

Summary

The Security Operations Center (SOC) Incident Responder provides advanced investigation, response, and escalation support for security incidents affecting Aspire Technology Partners' Managed Services Clients. Primary responsibilities include correlating data from multiple security and telemetry sources; determining the scope, impact, and severity of potential compromise; performing advanced analysis; coordinating containment and remediation activities; providing recommendations to customers and internal teams; and serving as an escalation point for SOC Level 1 and Level 2 analysts.The Incident Responder uses SIEM, endpoint/XDR, network security, threat intelligence, OSINT, and AI-assisted investigation tools to investigate incidents and take immediate action or recommend an appropriate course of action to safeguard Aspire's Managed Services Clients. The Incident Responder will document investigations and create clear narratives that support conclusions and actions taken; distinguish true security incidents from false positives and expected activity; track investigations through resolution; communicate with customers and internal teams; and support the continued development of detection, response, and containment procedures.ESSENTIAL DUTIES AND RESPONSIBILITIES- MAY INCLUDE THE FOLLOWING: OTHER DUTIES MAY BE ASSIGNED.Ensure SOC security incidents and cases are investigated, documented, escalated, and resolved within established SLAs and operational proceduresStay current with security vulnerabilities, threat actor techniques, attacks, indicators of compromise, and defensive countermeasuresInvestigate and provide advanced technical analysis of security incidents and suspected compromise across customer environmentsCreate and run advanced queries in SIEM, endpoint/XDR, and other security platforms to identify, scope, and troubleshoot security issuesCorrelate telemetry from multiple sources, including endpoint, identity, email, network, cloud, and security platforms, to determine incident scope and impactUse threat intelligence, OSINT, and AI-assisted investigation and analysis tools to enrich investigations and accelerate incident responseProvide recommendations and support for containment, remediation, and recovery actions, including malware and account-compromise incidentsOpen, track, update, and close security incidents and cases in ServiceNow in accordance with SOC documentation standardsServe as an escalation point for SOC Level 1 and Level 2 analysts and provide guidance during complex investigationsWork directly with other SOC Incident Responders, SOC Engineering, DevOps, NOC Engineers, and other internal teams as required for issue resolutionProvide clear and timely communication to customers and affected stakeholders regarding security incidents, investigation status, recommended actions, and resolutionMaintain detailed investigation notes, evidence, timelines, findings, and resolution activities within operational management systemsMaintain customer technical information and incident-response documentation in accordance with defined documentation standardsSupport the development and improvement of detections, investigation procedures, runbooks, containment processes, and response workflowsAssess and recommend appropriate security solutions, integrations, and operational improvements based on incident findings and recurring threatsPrepare SOC and incident-response reports as required and communicate findings to customers, peers, team members, and managementObtain and maintain technical or professional certifications applicable to the position or as directedProvide emergency on-call support on a rotating schedulePerform other duties as assignedRequirementsMINIMUM EDUCATION AND EXPERIENCE:Bachelor's Degree3-5 years of Security Incident Response and security experienceKnowledge and understanding of event/alert management, incident management, and change management processesPREFERRED EDUCATION AND EXPERIENCE:5+ years of experience working in a NOC or SOC5+ years of networking and/or security experienceExperience with Security Management and SIEM platforms (e.g., Exabeam)Experience with endpoint/XDR, identity, email, network, and cloud security investigation technologiesExperience utilizing OSINT, threat intelligence, and AI-assisted security investigation and analysis tools#J-18808-Ljbffr

Job Description

The Security Operations Center (SOC) Incident Responder provides advanced investigation, response, and escalation support for security incidents affecting Aspire Technology Partners' Managed Services Clients. Primary responsibilities include correlating data from multiple security and telemetry sources; determining the scope, impact, and severity of potential compromise; performing advanced analysis; coordinating containment and remediation activities; providing recommendations to customers and internal teams; and serving as an escalation point for SOC Level 1 and Level 2 analysts.The Incident Responder uses SIEM, endpoint/XDR, network security, threat intelligence, OSINT, and AI-assisted investigation tools to investigate incidents and take immediate action or recommend an appropriate course of action to safeguard Aspire's Managed Services Clients. The Incident Responder will document investigations and create clear narratives that support conclusions and actions taken; distinguish true security incidents from false positives and expected activity; track investigations through resolution; communicate with customers and internal teams; and support the continued development of detection, response, and containment procedures.ESSENTIAL DUTIES AND RESPONSIBILITIES- MAY INCLUDE THE FOLLOWING: OTHER DUTIES MAY BE ASSIGNED.Ensure SOC security incidents and cases are investigated, documented, escalated, and resolved within established SLAs and operational proceduresStay current with security vulnerabilities, threat actor techniques, attacks, indicators of compromise, and defensive countermeasuresInvestigate and provide advanced technical analysis of security incidents and suspected compromise across customer environmentsCreate and run advanced queries in SIEM, endpoint/XDR, and other security platforms to identify, scope, and troubleshoot security issuesCorrelate telemetry from multiple sources, including endpoint, identity, email, network, cloud, and security platforms, to determine incident scope and impactUse threat intelligence, OSINT, and AI-assisted investigation and analysis tools to enrich investigations and accelerate incident responseProvide recommendations and support for containment, remediation, and recovery actions, including malware and account-compromise incidentsOpen, track, update, and close security incidents and cases in ServiceNow in accordance with SOC documentation standardsServe as an escalation point for SOC Level 1 and Level 2 analysts and provide guidance during complex investigationsWork directly with other SOC Incident Responders, SOC Engineering, DevOps, NOC Engineers, and other internal teams as required for issue resolutionProvide clear and timely communication to customers and affected stakeholders regarding security incidents, investigation status, recommended actions, and resolutionMaintain detailed investigation notes, evidence, timelines, findings, and resolution activities within operational management systemsMaintain customer technical information and incident-response documentation in accordance with defined documentation standardsSupport the development and improvement of detections, investigation procedures, runbooks, containment processes, and response workflowsAssess and recommend appropriate security solutions, integrations, and operational improvements based on incident findings and recurring threatsPrepare SOC and incident-response reports as required and communicate findings to customers, peers, team members, and managementObtain and maintain technical or professional certifications applicable to the position or as directedProvide emergency on-call support on a rotating schedulePerform other duties as assignedRequirementsMINIMUM EDUCATION AND EXPERIENCE:Bachelor's Degree3-5 years of Security Incident Response and security experienceKnowledge and understanding of event/alert management, incident management, and change management processesPREFERRED EDUCATION AND EXPERIENCE:5+ years of experience working in a NOC or SOC5+ years of networking and/or security experienceExperience with Security Management and SIEM platforms (e.g., Exabeam)Experience with endpoint/XDR, identity, email, network, and cloud security investigation technologiesExperience utilizing OSINT, threat intelligence, and AI-assisted security investigation and analysis tools#J-18808-Ljbffr