Security Operations Center (SOC) Analyst – SIEM / Splunk

Position Title: Security Operations Center (SOC) Analyst – SIEM / Splunk 
Location: Remote (U.S.) with Occasional Travel 
Client: Federal / Public Sector Programs 
Work Authorization: Candidates must be authorized to work in the United States. U.S. Citizenship may be required based on client assignment. 
📩 To apply, please submit your resume to careers@wintrio.com or complete the application form below. 

Job Summary 

WINTrio LLC is seeking a Security Operations Center (SOC) Analyst with experience supporting Security Information and Event Management (SIEM) platforms, particularly Splunk, within Federal cybersecurity environments. 

This role is responsible for monitoring security events, investigating alerts, supporting incident response activities, conducting threat analysis, and enhancing operational visibility across enterprise systems. The successful candidate will help protect Federal environments by identifying suspicious activity, responding to security incidents, supporting continuous monitoring initiatives, and improving detection capabilities across cloud, network, application, and endpoint environments. 

The ideal candidate possesses strong analytical skills, experience working in a SOC or cybersecurity operations environment, and the ability to investigate and respond to security events in accordance with Federal cybersecurity requirements. 

Job Responsibilities 

• Monitor security alerts, events, and indicators using Splunk, SIEM dashboards, endpoint security platforms, network monitoring tools, and cloud security services. 

• Triage, investigate, document, and escalate security incidents based on severity, risk, mission impact, and established procedures. 

• Correlate security events across firewalls, endpoints, identity systems, vulnerability scanners, applications, and cloud platforms. 

• Develop, maintain, and refine Splunk searches, alerts, dashboards, reports, and correlation rules. 

• Support incident response activities, including containment, eradication, recovery, evidence collection, and after-action reporting. 

• Analyze logs from Windows, Linux, Active Directory, Azure AD/Entra ID, cloud services, firewalls, IDS/IPS solutions, endpoint detection platforms, and enterprise applications. 

• Support continuous monitoring, threat hunting, insider threat investigations, and suspicious activity detection efforts. 

• Document incidents, findings, timelines, remediation actions, and lessons learned using ServiceNow, JIRA, or similar tracking systems. 

• Support reporting activities aligned with Federal cybersecurity requirements, SLAs, compliance mandates, and incident response procedures. 

• Assist with SOC process improvement initiatives, playbook development, detection engineering, and workflow automation efforts. 

• Collaborate with cybersecurity, infrastructure, cloud, and application teams to strengthen organizational security posture. 

Required Qualifications 

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience. 

• Minimum three (3) years of experience supporting cybersecurity operations, SOC activities, incident response, threat monitoring, or SIEM administration. 

• Hands-on experience using Splunk or comparable SIEM platforms. 

• Strong understanding of incident response processes, threat detection methodologies, log analysis, and alert triage. 

• Experience analyzing endpoint, network, identity, application, and cloud security logs. 

• Familiarity with Federal cybersecurity requirements, continuous monitoring programs, and compliance reporting. 

• Strong written and verbal communication skills. 

• Strong analytical, investigative, and problem-solving abilities. 

Technical Areas 

Security Operations & Incident Response 

• Security Event Monitoring 

• Alert Triage 

• Incident Investigation 

• Incident Response 

• Threat Detection 

• Threat Hunting 

• Continuous Monitoring 

• Security Reporting 

SIEM & Log Analysis 

• Log Correlation 

• Security Analytics 

• Detection Engineering 

• Correlation Rule Development 

• Dashboard Development 

• Operational Reporting 

Threat Intelligence & Analysis 

• MITRE ATT&CK Framework 

• CISA Known Exploited Vulnerabilities (KEV) 

• CVE Analysis 

• Indicators of Compromise (IOC) 

• Threat Intelligence Enrichment 

• Adversary Tactics & Techniques 

Cloud & Enterprise Security 

• AWS Security Monitoring 

• Azure Security Monitoring 

• Identity Security Monitoring 

• Network Security Monitoring 

• Endpoint Security Monitoring 

Tools & Platforms 

SIEM Platforms 

• Splunk Enterprise 

• Splunk Enterprise Security 

• ELK Stack 

• Microsoft Sentinel 

• IBM QRadar 

Endpoint & EDR Platforms 

• CrowdStrike 

• Microsoft Defender 

• Carbon Black 

• Trellix 

• SentinelOne 

Network Security Tools 

• Firewalls 

• IDS/IPS Platforms 

• VPN Monitoring 

• NetFlow Analysis 

• Wireshark 

Identity & Access Security 

• Active Directory 

• Microsoft Entra ID (Azure AD) 

• Privileged Access Monitoring 

Cloud Security Monitoring 

• AWS CloudTrail 

• Amazon GuardDuty 

• AWS CloudWatch 

• Azure Monitor 

• Microsoft Defender for Cloud 

Incident Management & Collaboration 

• ServiceNow 

• JIRA 

• SOAR Platforms 

• Case Management Systems 

Scripting & Automation 

• Python 

• PowerShell 

• Bash 

Preferred Certifications 

• CompTIA Security+ 

• CompTIA CySA+ 

• Splunk Core Certified User 

• Splunk Core Certified Power User 

• Splunk Enterprise Security Certified Administrator 

• GIAC Certified Incident Handler (GCIH) 

• GIAC Security Essentials (GSEC) 

• Certified Ethical Hacker (CEH) 

• Microsoft Security Operations Analyst Associate 

Preferred Qualifications 

• Experience supporting Federal SOC, continuous monitoring, or incident response programs. 

• Experience creating Splunk dashboards, alerts, correlation searches, and executive-level reporting. 

• Experience supporting SOAR automation initiatives, threat hunting programs, or detection engineering activities. 

• Experience supporting cloud-hosted or hybrid technology environments. 

• Familiarity with NIST SP 800-53, NIST SP 800-61, FISMA, DHS CDM, and FedRAMP requirements. 

• Experience supporting enterprise cybersecurity operations centers. 

Work Environment 

• Full-time position. 

• Remote within the United States. 

• Standard business hours Monday through Friday. 

• Occasional travel may be required in support of customer meetings, incident response activities, and program requirements. 

WINTrio Benefits 

• Healthcare (Medical, Dental, and Vision) 

• Flexible Spending Account (FSA) and Health Savings Account (HSA) 

• 401(k) and Retirement Savings Plan 

• Annual Bonus and Profit Sharing Opportunities 

• Paid Time Off (PTO) and Vacation 

• Employee Assistance Program (EAP) 

• Life, Personal, and Voluntary Disability Insurance 

Growth Opportunities 

There is ample opportunity to grow in multiple dimensions, including cybersecurity operations, incident response, threat hunting, cloud security, detection engineering, security automation, cyber defense, and cybersecurity leadership. We are a completely employee-driven company, and our continued success is built on the talent, dedication, and innovation of our team members. 

Equal Opportunity Employer 

WINTrio LLC is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.