About the Role
As a SOC Analyst at Argent Reach, you'll be part of the team that monitors our customers' environments around the clock. You'll monitor security alerts, investigate threats, triage incidents, and guide clients through response within a human-led, AI-powered security operations environment. You'll work closely with senior analysts and consultants to develop your skills, and you'll have direct exposure to a wide range of client environments across industries including healthcare, financial services, agriculture, and legal.
Schedule and Availability
This role operates within a 24/7 Security Operations Center environment. As such, candidates must be available and willing to work non-standard hours as operational needs require, including:
- Evening and overnight shifts
- Weekends (Saturday and Sunday)
- Holidays, including federal and company-observed holidays
- Shift coverage as determined by the SOC Lead
Scheduling is coordinated by the SOC Lead andmay vary based on team coverage needs, incident volume, and organizationalrequirements. Flexibility and reliability in schedule adherence are essentialto success in this role.
Key Responsibilities:
Incident Investigation & Response
- Perform in-depth investigations of security incidents across Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, and Defender for Cloud
- Investigate identity‑based threats in Microsoft Entra ID, endpoint activity, email and collaboration threats (phishing, inbox rules, OAuth abuse), and cloud/SaaS security events
- Analyze incidents involving malware, phishing campaigns, identity compromises, lateral movement and persistence
- Distinguish malicious activity from benign behavior using evidence‑based analysis
- Own incidents across all severities, driving investigation, escalating when appropriate, and closures of the incidents.
Triage & Decision-Making
- Validate alert fidelity and accurately identify false positives, benign activity, and true positive security incidents
- Decide when escalation may or may not be required and clearly document rationale
- Analyze logs from Microsoft 365, Entra ID, Azure AD, and endpoint telemetry to reconstruct attack timelines
- Identify trends in alert noise and recurring detection issues
Detection & Platform Feedback
- Develop and tune KQL‑based analytics rules, detections, and watchlists in Microsoft Sentinel
- Provide actionable feedback on detection fidelity, coverage gaps and tuning opportunities across Sentinel and Defender
- Conduct proactive threat hunting using the Microsoft security stack to identity activity that bypasses automated detections
- Assist with detection validation, analytics testing, and data enrichment initiatives
Documentation & Communication
- Produce high‑quality incident documentation, including investigation steps, findings, and conclusions
- Contribute to SOC playbooks, runbooks, and response procedures
- Support knowledge sharing and mentorship for Tier 1 analysts
Skills and Experience
- Successful candidates will bring a strong foundation in security operations, along with curiosity and the ability to reason through complex and ambiguous scenarios.
- Experience in a SOC, incident response, or security operations role
- Hands‑on experience with Microsoft Sentinel, including analytics rules, KQL queries, workbooks, and/or SOAR playbooks (Logic Apps)
- Proficiency in KQL (Kusto Query Language) for investigations and detection engineering
- Working knowledge of the Microsoft Defender XDR suite (Defender for Endpoint, Defender for Identity, Defender for Office 365)
- Experience investigating identity‑based threats in Microsoft Entra ID / Azure AD
- Understanding of Windows internals, Active Directory, and common attack techniques such as lateral movement, privilege escalation, and persistence
- Familiarity with the MITRE ATT&CK framework and mapping attacker behaviors to detections
- Ability to correlate activity across multiple data sources and clearly articulate why behavior is malicious or benign
- Comfortable operating in gray areas where alerts or evidence are incomplete or ambiguous
- Strong analytical skills, attention to detail, and the ability to work independently
- Clear written and verbal communication skills, including the ability to explain complex incidents to both technical and non‑technical stakeholders
- A continuous learning mindset and a collaborative, team‑oriented approach
Additional Experience
- Microsoft security certifications (SC‑200, AZ‑500, SC‑300) or equivalent certifications (Security+, GCIA, GCED)
- Experience building SOAR automation with Logic Apps
- Familiarity with Defender for Cloud and securing Azure workloads
- Experience in integrating threat intelligence into Sentinel
- Scripting experience (PowerShell, Python) for investigations or automation
- Experience in an MSSP environment
- Exposure to Microsoft Copilot for Security or other AI‑assisted security tools
- Knowledge of compliance frameworks (NIST, ISO 27001, CIS Controls)
- Familiarity with Microsoft Purview and non‑malware or identity‑centric investigations
What You Can Expect from Us
- A team that leads with integrity and values people first, customers and coworkers alike
- Direct mentorship from experienced cybersecurity practitioners
- Exposure to a wide range of industries, environments, and threat scenarios
- Competitive compensation and benefits