SOC Incident Responder

POSITION SUMMARY:

The Security Operations Center (SOC) Incident Responder provides advanced investigation, response, and escalation support for security incidents affecting Aspire Technology Partners’ Managed Services Clients. Primary responsibilities include correlating data from multiple security and telemetry sources; determining the scope, impact, and severity of potential compromise; performing advanced analysis; coordinating containment and remediation activities; providing recommendations to customers and internal teams; and serving as an escalation point for SOC Level 1 and Level 2 analysts.

The Incident Responder uses SIEM, endpoint/XDR, network security, threat intelligence, OSINT, and AI-assisted investigation tools to investigate incidents and take immediate action or recommend an appropriate course of action to safeguard Aspire’s Managed Services Clients. The Incident Responder will document investigations and create clear narratives that support conclusions and actions taken; distinguish true security incidents from false positives and expected activity; track investigations through resolution; communicate with customers and internal teams; and support the continued development of detection, response, and containment procedures.

ESSENTIAL DUTIES AND RESPONSIBILITIES- MAY INCLUDE THE FOLLOWING: OTHER DUTIES MAY BE ASSIGNED.

• Ensure SOC security incidents and cases are investigated, documented, escalated, and resolved within established SLAs and operational procedures
• Stay current with security vulnerabilities, threat actor techniques, attacks, indicators of compromise, and defensive countermeasures
• Investigate and provide advanced technical analysis of security incidents and suspected compromise across customer environments
• Create and run advanced queries in SIEM, endpoint/XDR, and other security platforms to identify, scope, and troubleshoot security issues
• Correlate telemetry from multiple sources, including endpoint, identity, email, network, cloud, and security platforms, to determine incident scope and impact
• Use threat intelligence, OSINT, and AI-assisted investigation and analysis tools to enrich investigations and accelerate incident response
• Provide recommendations and support for containment, remediation, and recovery actions, including malware and account-compromise incidents
• Open, track, update, and close security incidents and cases in ServiceNow in accordance with SOC documentation standards
• Serve as an escalation point for SOC Level 1 and Level 2 analysts and provide guidance during complex investigations
• Work directly with other SOC Incident Responders, SOC Engineering, DevOps, NOC Engineers, and other internal teams as required for issue resolution
• Provide clear and timely communication to customers and affected stakeholders regarding security incidents, investigation status, recommended actions, and resolution
• Maintain detailed investigation notes, evidence, timelines, findings, and resolution activities within operational management systems
• Maintain customer technical information and incident-response documentation in accordance with defined documentation standards
• Support the development and improvement of detections, investigation procedures, runbooks, containment processes, and response workflows
• Assess and recommend appropriate security solutions, integrations, and operational improvements based on incident findings and recurring threats
• Prepare SOC and incident-response reports as required and communicate findings to customers, peers, team members, and management
• Obtain and maintain technical or professional certifications applicable to the position or as directed
• Provide emergency on-call support on a rotating schedule
• Perform other duties as assigned

MINIMUM EDUCATION AND EXPERIENCE:

• Bachelor’s Degree
•  3-5 years of Security Incident Response and security experience
•  Knowledge and understanding of event/alert management, incident management, and change management processes

PREFERRED EDUCATION AND EXPERIENCE: 

• Master’s degree preferred
•  5+ years of experience working in a NOC or SOC
•  5+ years of networking and/or security experience
•  Experience with Security Management and SIEM platforms (e.g., Exabeam)
•  Experience with endpoint/XDR, identity, email, network, and cloud security investigation technologies
•  Experience utilizing OSINT, threat intelligence, and AI-assisted security investigation and analysis tools
•  Experience with ticket and case management platforms (e.g., ServiceNow)
•  Possession of industry certifications (Security+, CISSP, GCIH, ECIH, ITIL, or similar)

OTHER SKILLS AND ABILITIES:

• Excellent interpersonal skills with the ability to develop and maintain strong working relationships
• Strong work ethics and professional judgment
• Strong written and verbal communication skills, including the ability to clearly document and explain technical findings
• Ability to prioritize tasks and incidents based on risk, severity, customer impact, and operational requirements
• Strong organizational and case-management skills
• Ability to perform effectively during high-severity incidents and manage multiple investigations in a fast-paced environment
• Excellent customer service and customer communication skills
• Familiarity with ITIL, incident management, and change management processes
• Proficiency with Microsoft Office and the ability to learn specialized security, investigation, and operational tools
• Detail-oriented approach to investigation, evidence collection, documentation, and follow-through
• Occasional overtime may be required

TRAVEL: (Limited to No Travel)

PHYSICAL DEMANDS: The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

While performing the duties of this job, the employee is regularly required to sit and talk or hear. The employee frequently is required to stand; walk; and use hands to finger, handle, or feel objects, tools, or controls. The employee is occasionally required to reach with hands and arms. The employee must occasionally lift and/or move up to 35 pounds. Specific vision abilities required by this job involve normal vision.

WORK ENVIRONMENT: The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

The noise level in the work environment is usually quiet to moderate.