SOC Analyst (Mid-Level)

US Remote (Eastern-hours shift coverage) | 12-Month 1099 Contract | 3 Openings

Principals only. No agencies, no corp-to-corp, no third-party submissions.

The Role

Nearshore Cyber is recruiting three experienced SOC analysts for a partner's enterprise client. This is hands-on-keyboard security operations work in a mature, Splunk-centered environment: you will triage and investigate alerts, hunt threats, write and tune detections, and automate away the repetitive work that slows response down. The team runs shift coverage, so flexibility on schedule is a condition of the role, not a nice-to-have.

This suits an analyst in the 3–5 year range who has outgrown pure alert-queue work and wants to build detection content and automation, not just consume it.

What You Will Do

• Perform advanced SOC analysis: triage, investigation, incident reporting, and threat hunting
• Build and refine security detection content in Splunk Enterprise Security
• Work across ticketing and orchestration platforms to remediate alerts and improve detection quality
• Drive continuous improvement: alert tuning, log management, and automation of repetitive tasks

Required Qualifications

• 3–5 years as a cybersecurity analyst, including a minimum of 3 years in a SOC environment
• Demonstrated experience in incident response, triage, threat detection, and alert tuning
• Advanced Splunk ES/Core skills, including writing complex SPL queries — this is a must
• Familiarity with email and endpoint security platforms such as Proofpoint TAP/TRAP and CrowdStrike Falcon
• Comfortable with shift work
• Strong communicator who works well with cross-functional teams
• Genuine interest in growing a cybersecurity career

Preferred Qualifications

• Hands-on experience with cloud security platforms such as Wiz and Zscaler
• Certifications such as CompTIA Security+, Network+, OSCP, or CySA+
• Scripting in Python or PowerShell for automation and enrichment
• Experience applying AI tools (Claude Code, Codex, Cursor, LLMs) to security problems

Logistics

• Independent contractor (1099) engagement for a 12-month term, extension possible
• Fully remote within the US; working hours align to US Eastern time with shift rotation
• Competitive hourly rate, DOE
• Direct applicants only; submissions through staffing firms will not be considered