SOC Analyst Consultant (CrowdStrike Experience) - Remote (Mexico)

About us: At Echelon Risk + Cyber, we believe in defending basic human rights to security and privacy. We seek a highly skilled and experienced SOC Analyst, Consultant to join our dynamic team at Echelon Risk + Cyber, a leading cybersecurity consulting firm. Our next team member will be ready to roll up their sleeves and identify opportunities for our clients and for Echelon internally with unquestioned integrity. This team member will be passionate about cybersecurity and ready to use their knowledge to be an Entrepreneurial Problem Solver and work alongside their Echelon team members to build creative solutions.

As SOC Analyst, Consultant you will act as the lead technical point person for MDR/SOC alerts, working across a portfolio of client environments rather than a single network. You will run deep-dive investigations on endpoint, identity, email, and cloud detections, drive containment and eradication, and tune detection content so that the next alert is better than the last.

At Echelon, you will have the opportunity to engage with clients, business partners and systems that are at the cutting edge of technology. We allow our employees to build from the ground up and make an impact across the organization. We look for driven and proactive people that are eager to contribute to a distinct and thriving Cybersecurity services organization, that can adapt to a rapid and changing environment.

This is a remote position from anywhere in Mexico.

What You Will Do:

• Own Tier 2 and Tier 3 investigations escalated from frontline triage: establish scope and root cause, identify affected hosts, users, and identities, and drive containment, eradication, and recovery.
• Perform hands-on endpoint investigation and response in EDR/MDR platforms - process and telemetry analysis, remote host triage, artifact collection, host isolation, and analysis of malicious binaries and scripts.
• Investigate identity and cloud detections across Microsoft 365, Entra ID, Active Directory, AWS, and Azure, including business email compromise, token and session theft, MFA abuse, and privilege escalation.
• Triage and investigate email security alerts - phishing and BEC analysis, header, URL, and attachment inspection, tenant-wide message trace and remediation, and mail flow and policy recommendations.
• Review vulnerability scanning and exposure management output, validate findings, and help clients prioritize remediation based on exploitability, exposure, and business context.
• Flag detection tuning opportunities (noisy rules, missed coverage) for the engineering team based on investigation findings.
• Build and maintain automation and SOAR playbooks that take repetitive work out of the triage queue.
• Run threat hunts using threat intelligence, IoC data, and adversary TTPs mapped to MITRE ATT&CK, and convert hunt findings into durable detections.
• Document the full incident lifecycle, including root cause analysis and actions taken, and produce clear reports and recommendations for both technical and executive audiences.
• Serve as the escalation point for confirmed incidents, coordinating with client IT and security teams, Echelon's incident response and offensive security practices, and third parties through to resolution.
• Support the growth of the Managed SOC/MDR service - standard operating procedures and runbooks, client and platform onboarding, configuration and tuning, quality review of frontline work, and mentoring and training analysts.
• Participate in after-hours and on-call rotations for SOC alert escalation and response requirements.

Your knowledge, skills, and abilities:

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related discipline, or equivalent professional experience.
• An experienced Tier 2 or Tier 3 SOC analyst, ready to help develop and grow a SOC service and team.
• Expertise investigating and mitigating security incidents across diverse environments, including on-premises, cloud, and hybrid infrastructures.
• SIEM: hands-on experience investigating across log sources, building and tuning correlation rules and use cases, and writing queries in at least one query language (e.g., CQL, SPL, KQL, YARA-L).
• Email security: experience investigating phishing, BEC, and malicious delivery, and working with email security platforms (e.g., Microsoft Defender for Office 365, Proofpoint, Mimecast, Abnormal).
• Vulnerability management: ability to interpret scanning and exposure management output (e.g., Tenable, Qualys, Rapid7, Falcon Exposure Management) and prioritize findings using CVSS, EPSS, and known-exploited-vulnerability data.
• Supporting stack: familiarity with identity platforms (Entra ID, Active Directory), firewall and network telemetry, web and DNS filtering, and endpoint hardening controls.
• Solid grounding in Windows, Linux, and macOS internals and the forensic artifacts each produces.
• Strong understanding of threat intelligence integration, adversary TTPs, and the MITRE ATT&CK framework.
• Clear written and verbal communication - able to walk a system administrator through remediation and brief an executive on impact on the same day.
• Desired Certifications: CompTIA Security+ and Cybersecurity Analyst (CySA+), ISC2 CC and SSCP, EC-Council Certified Incident Handler (ECIH), GIAC Certified Incident Handler (GCIH) or Forensic Analyst (GCFA), and SIEM/EDR certifications (e.g., CrowdStrike, Splunk, Google SecOps/Chronicle, SentinelOne) are a plus.
• Strong English communication (C1/C2 Level) written and verbal.
• Authorized to work in Mexico without visa sponsorship.

Preferred Qualifications:

• 3–5 years of hands-on experience in SOC operations, preferably for a SOC or MDR service provider (e.g., MSSP), supporting multiple clients concurrently.
• Exposure to additional EDR/XDR platforms (e.g., Microsoft Defender for Endpoint, SentinelOne, Trellix, Blackpoint) and SIEM platforms (e.g., Google SecOps/Chronicle, Splunk, Microsoft Sentinel, IBM QRadar).
• SOAR and automation experience (e.g., Falcon Fusion, Splunk SOAR, FortiSOAR, Tines, Torq), including API-based integrations between security tools.
• Digital forensics and malware analysis experience, including memory and disk triage and sandbox analysis.
• Detection engineering experience against native cloud logging in AWS, Azure, or GCP.
• Experience supporting purple team exercises, detection validation, or tabletop exercises.
• Experience mentoring frontline analysts or owning shift and queue quality metrics.

CrowdStrike Falcon Experience:

CrowdStrike Falcon is a primary MDR platform; hands-on Falcon experience is preferred but not required.

• Preferred: comfort working in the Falcon console - reviewing and dispositioning detections, reading execution detail and process trees, and checking host and sensor status.
• Preferred: hands-on Real Time Response (RTR) for live host triage, artifact collection, and remediation, along with network containment.
• Preferred: prevention policy tuning, exclusions, IOC and custom IOA management, and sensor deployment and health.
• Preferred: query-based hunting in Advanced Event Search or Next-Gen SIEM (LogScale/CQL), exposure to modules such as Identity Protection, Exposure Management, and Fusion workflows, and experience supporting multiple customer tenants.
• Preferred: CrowdStrike certifications (CCFA, CCFR, CCFH).

Why Echelon?

We are committed to creating an inclusive environment for our team with unquestioned integrity. If you have a special need that requires accommodation, please let your recruiter know. One of our core values is "People with Personality," and we want to allow you the space to bring your full self to work.

We Currently Offer The Following Benefits:

• Access to private medical insurance through MetLife
• Life insurance policy via MetLife
• 30-day Christmas bonus and a monthly technology stipend
• Contribution of 8% of the employee's salary to a savings fund
• Flexible vacation policy that allows you to manage your schedule and rest and recharge when you need to.
• Family-friendly benefits, extended parental leave for when you need to spend critical time with new family members, and employer-paid short-term and long-term disability
• Support for individual development through certifications, continued learning, conferences, and more

We value a diverse workforce and a culture of inclusivity and belonging. All employment decisions shall be made without regard to age, race, creed, color, religion, gender, national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, citizenship status, or any other basis as protected by federal, state, or local law. Echelon Risk + Cyber is an Equal Opportunity Employer.