An Incident Analyst or Responder investigates an IT-related incident: an unplanned interruption to a service, a reduction in the quality of a service, or an event that has not yet impacted the service to the customer. Works to restore a normal service operation as quickly as possible and to minimize the impact on business operations.
Monday - Friday, 7:00 AM - 6:30 PM PST (Coverage shift model) 1. Role Overview Technet is seeking a SOC Threat Detection & Incident Response Analyst to provide active security monitoring, threat detection, incident triage, and response for a critical energy-sector utility billing and data management platform. In this role, you will be responsible for active triage and correlation across CrowdStrike Falcon, a centralized Wazuh SIEM, AWS-native security services (GuardDuty, Security Hub, WAF), and application middleware. You will execute incident response actions and proactive threat hunts in strict alignment with utility emergency operations and incident response frameworks (CEOP/CIRP). 2.
Technical Stack & Systems Monitored Detection & SIEM Tools:
Key Responsibilities Active SOC Monitoring & Triage:
Monitor cloud, endpoint, network, and application security alerts Monday through Friday (7:00 AM - 6:30 PM PST), adhering to strict SLAs (≤ 15 minutes for Critical severity; ≤ 1 hour for High severity).
Multi-Stage Threat Correlation:
Correlate disparate signals across CrowdStrike Falcon endpoint detections, AWS GuardDuty anomalies, CloudTrail management events, IIS web server logs, and RDS SQL Server audit records to identify complete attack chains.
Threat Hunting:
Conduct hypothesis-driven and intelligence-driven threat hunts focusing on cloud credential hijacking, IAM privilege escalation, impossible-travel anomalies, MFA bypass, and unauthorized data staging/exfiltration.
Integration Edge & File Transfer Monitoring:
Perform targeted monitoring of GoAnywhere MFT, Dell Boomi, and external data exchanges (PG&E feeds) for anomalous file transfers, off-hours execution, or unauthorized outbound connections.
Incident Response & Containment:
Execute response playbooks aligned with enterprise CEOP and CIRP frameworks. Perform host isolation recommendations, credential revocation coordination, and initial evidence preservation.
Vulnerability & Posture Prioritization:
Review daily vulnerability scan outputs from Wazuh SCA/SSM and posture findings from Prowler; prioritize findings by business impact and exploitability, and track remediation with engineering teams.
Reporting & Governance:
Assist in preparing monthly security posture reviews, threat intelligence summaries, and quarterly executive risk dashboards. 4.
3+ years of hands-on experience in a Security Operations Center (SOC), Threat Analysis, or Incident Response role.
Tooling Proficiency:
Direct experience analyzing alerts and querying logs within CrowdStrike Falcon , Wazuh (or ELK/OpenSearch/Splunk SIEM), and AWS Security Hub / GuardDuty .
Cloud & Identity Threat Knowledge:
Practical experience analyzing AWS CloudTrail logs, detecting IAM abuse patterns, credential spraying, and web application attack vectors (OWASP Top 10, AWS WAF rules).
Log Analysis Skills:
Strong ability to inspect and analyze raw logs from Windows Event Viewer, IIS web servers, database audit logs (SQL Server), and API/MFT transactional logs.
Incident Response Execution:
Understanding of formal incident response methodologies (containment, eradication, recovery) and playbook execution. U.S.
Data Residency Requirement:
Must reside and work exclusively within the United States. 5. Preferred Qualifications & Certifications CompTIA CySA+, Security+, or GIAC Certified Incident Handler (GCIH) GIAC Certified Enterprise Defender (GCED) or GIAC Cloud Forensics (GCFA) Certified Information Systems Security Professional (CISSP) or
CISM AWS
Certified Cloud Practitioner or AWS Certified Solutions Architect Associate Prior experience in utility, public power, or critical infrastructure operations.
