Senior SOC Analyst

Role Overview

What You'll Do

• Hunt proactively across infrastructure, cloud, identity, and endpoint, working from hypotheses, not just waiting on alerts.
• Build, tune, and maintain detections mapped to real attacker TTPs (MITRE ATT&CK), not whatever ships default from the vendor.
• Own incidents end to end: triage, containment, root cause, and a report that leads to an actual fix.
• Push back on any tuning decision, exclusion, or 'known good' assumption that trades visibility for noise reduction, and catch it before it ships.
• Partner with Red Team on purple-team exercises, turning every finding into a detection.
• Extend detection and monitoring coverage into our AI agent stack: prompt injection, tool misuse, credential exposure in agent workflows.
• Do enough malware analysis and reverse engineering to actually understand what you're looking at, not just what a sandbox report says.
• Mentor junior analysts and raise the bar on what 'triaged' actually means.

Who You Are

• 6+ years in a SOC, threat hunting, or DFIR role, with real incident ownership, not just alert queue work.
• GCFA, GCIH, GCIA, or equivalent DFIR/detection engineering credential strongly preferred.
• Real depth in at least three of: EDR internals and endpoint telemetry, cloud security monitoring (AWS/GCP), network forensics, malware analysis, SIEM and detection-as-code, identity threat hunting.
• Comfortable writing your own detection logic and tooling in Python or a proper query language, not copy-pasting from a vendor blog.
• You think like an attacker when you write a detection, because that's the only way to catch one.
• You know the difference between reducing noise and creating a blind spot, and you've caught that mistake before it cost someone.
• You can write a report that gets fixed, not filed.

About Deriv

Job Details