SOC Technician (Security Operations Center)

This role serves as the first line of response for security incidents, working closely with our technical support teams to triage, contain, and escalate cybersecurity threats while ensuring business continuity.

The ideal candidate has experience in managed services or multi-client IT environments, understands modern security operations, and is comfortable making sound decisions during after-hours incidents. While security is the primary responsibility, the role will also provide general helpdesk support during non-incident periods.

This position includes participation in an on-call rotation to support security incidents outside of scheduled hours.

Key Responsibilities

• Monitor, triage, and respond to security incidents during assigned shifts and on-call periods.
• Serve as the primary after-hours security resource for technical teams.
• Perform initial containment activities using established incident response runbooks, including:
• Isolating compromised endpoints
• Disabling user accounts
• Revoking sessions and authentication tokens
• Preserving logs and forensic evidence
• Investigate Microsoft 365 and Microsoft Entra ID sign-in, audit, and security logs.
• Perform Endpoint Detection and Response (EDR/XDR) investigations, preferably using SentinelOne.
• Analyze alerts for common attack patterns including:
• Phishing
• Business Email Compromise (BEC)
• Credential compromise
• Adversary-in-the-Middle (AiTM)
• Token theft
• Escalate incidents appropriately to internal leadership or external SOC providers (e.g., SentinelOne Vigilance) when required.
• Provide guidance and security recommendations to technicians during active incidents.
• Maintain thorough incident documentation and accurate case notes.
• Exercise sound judgment regarding escalation, balancing rapid containment with appropriate notification.

• Provide general IT support during non-incident periods.
• Administer Microsoft 365 and Microsoft Entra ID environments.
• Support Windows desktops, Windows Server, and Active Directory.
• Assist with endpoint management using Microsoft Intune and Remote Monitoring & Management (RMM) tools.
• Participate in standard helpdesk activities as workload permits.

Required Qualifications

• Minimum of 2 years' experience in a Managed Service Provider (MSP) or multi-client helpdesk environment.
• Previous SOC Analyst, Security Analyst, or incident response experience is strongly preferred.
• Comfortable participating in an after-hours on-call rotation.
• Ability to work independently during evenings, weekends, and off-hours.
• Strong written and verbal English communication skills.
• Excellent documentation and organizational skills.
• Demonstrated ability to make sound escalation decisions under pressure.

• Experience with EDR/XDR platforms, preferably SentinelOne.
• Understanding of Microsoft 365 security administration.
• Experience investigating Microsoft Entra ID sign-in and audit logs.
• Knowledge of Windows operating systems, Active Directory, and endpoint management.
• Familiarity with incident response procedures and evidence preservation.
• Basic networking and security troubleshooting skills.

• Security+ certification.
• Microsoft SC-200 (Security Operations Analyst) certification.
• SentinelOne certifications or hands-on operational experience.
• Experience with Microsoft Intune.
• Experience with ConnectWise Automate or similar RMM platforms.
• PowerShell and Microsoft Graph scripting experience.
• Experience leveraging Microsoft Copilot or other AI-powered IT and security tools.

• Strong analytical and troubleshooting skills.
• Calm and effective under pressure