Principal Security Operations Center Analyst

Huntress

. Own complex, multi-host intrusions end to end, from triage through forensic timelining, root cause and remediation, across endpoint, identity (Microsoft 365 / Google Workspace) and SIEM telemetry .

Posted 11/10/2026full-timeRemote • AustraliaLead💰 A$180,000 - A$215,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in SOC operations, incident response, and forensic investigations, with a strong focus on automation and quality assurance in threat detection and remediation. Proven ability to lead teams, mentor peers, and communicate complex findings effectively to diverse audiences.

Highest-signal resume keywords

SOC OperationsIncident ResponseMalware AnalysisDetection EngineeringTechnical Leadership

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Forensic InvestigationMalware AnalysisMITRE ATT&CK FrameworkWindows AdministrationCloud Identity RemediationPythonPowerShellSIEM Query TuningAutomation WorkflowsIncident Reporting

Soft Skills

MentoringCommunicationCultural AwarenessProblem-SolvingCollaboration

Tools & Technologies

Microsoft 365Google WorkspaceActive DirectoryGroup PolicyClaudeCodexRMM ToolsAzureAWSGCP

Industry Keywords

SOCDFIRMDRIncident ResponseThreat HuntingCybersecurityAutomationQuality ControlResearch PublicationDiverse Backgrounds

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformLinuxMacOSPython

About the role

Key responsibilities & impact

Own complex, multi-host intrusions end to end, from triage through forensic timelining, root cause and remediation, across endpoint, identity (Microsoft 365 / Google Workspace) and SIEM telemetry
Act as the SOC's technical partner to Product, Product Research and Detection Engineering & Threat Hunting, turning recurring floor pain points into lasting detection, suppression and product fixes
Perform advanced static and dynamic malware analysis, research emerging tradecraft, and publish findings through Huntress content
Find repeatable investigation patterns and toil, then design, build and maintain automation and human-led agentic workflows with Workflow Engine owners, Product and Engineering, with inline QC/QA
Own quality on the floor by grading AI agent and analyst output, tracing misses to root cause, fixing them at the source, and acting as final technical reviewer on detection tuning, suppression decisions and high-impact incident reports
Provide technical leadership and mentoring across the team through investigation standards, case reviews, ride-alongs, knowledge sessions, SOC direction advice and candidate assessment
Be a cultural driver for the team and champion the “agents handle volume, humans own quality” mindset
Handle threat-related escalations from SOC Support, explaining complex activity and business risk to technical and non-technical audiences
Work closely with Product, Product Research and Detection Engineering & Threat Hunting
Support publishing research through Huntress blogs, webinars and conference talks

Requirements

What you’ll need

6+ years in SOC, Incident Response, DFIR or MDR roles, including leading multi-host intrusion investigations
Deep knowledge of attacker tradecraft across MITRE ATT&CK (credential access, lateral movement, persistence, defense evasion, living-off-the-land) and how to detect it
Deep forensic and investigation experience across Windows, macOS and Linux
Strong cloud identity investigation and remediation experience in Microsoft 365 / Entra ID and Google Workspace
Advanced static and dynamic malware analysis, including extracting IOCs and determining capability and intent
Strong enterprise Windows administration (Active Directory, Group Policy, PowerShell, domain trusts) and core networking knowledge
Strong hands-on AI skills: daily use of tools such as Claude and Codex for analysis, research and building automation and agentic workflows (Python, PowerShell or similar), with sound judgment about validating their output
Understanding of inline quality delivery: building QC/QA into workflows as they run (quality gates, statistical sampling, drift detection and regression testing) rather than relying on after-the-fact review
Proven technical leadership and mentoring: you've raised the standard of a team, not just your own work, and you explain complex findings clearly in writing and verbally
Published research, blogs, conference talks or open-source security tooling
Detection engineering experience: writing and tuning detections and SIEM queries
Investigations in other cloud platforms such as Azure, AWS or GCP
Previous MSP/MSSP/MDR experience and familiarity with RMM tools
People from all culturally diverse backgrounds, including Aboriginal & Torres Strait Islander Peoples, are encouraged to apply.

Benefits

Comp & perks

Fully remote work
At least one annual trip to the US for Summer Summit, with additional local events in Australia!
New starter home office set up reimbursement ($800 AUD)
12 weeks paid parental leave for both primary and secondary carers
Monthly digital allowance for personal phone and internet costs ($185 AUD)
Monthly home office tech stipend to upgrade or replace equipment ($40 AUD)
Subsidised private health insurance through our preferred provider
Stock options for all full-time employees
Access to the BetterUp platform for coaching, personal, and professional growth