Security Operations

• Monitor client environments continuously for cybersecurity threats using SIEM, endpoint detection and response, identity protection, and email security platforms
• Own the live alert queue during each shift; triage detections, determine scope and severity, and execute or authorize appropriate responses
• Conduct structured shift handoffs and ensure every detection, investigation, and client commitment has a clear owner
• Investigate account compromise, business email compromise, social engineering, malware, and ransomware incidents
• Analyze servers, workstations, identities, and other potentially compromised assets
• Contain and remediate confirmed threats using automation workflows, scripts, policies, playbooks, and platform controls
• Escalate incidents according to the incident response plan when they exceed the analyst’s authority or expertise
• Provide timely, professional incident communications to clients and internal stakeholders
• Perform scheduled vulnerability scanning across client environments
• Support CMMC and NIST SP 800-171 compliance objectives by producing required monitoring evidence, logs, and reports
• Review overnight Tines automation logs, validate automated actions, and remediate or escalate exceptions
• Respond to overnight escalations while on call and document all actions
• Identify repetitive manual work and false positives for automation or detection tuning
• Test and provide structured feedback on new detections and automation workflows
• Track and document all work in the ticketing system
• Meet KPIs, support peers across both shifts, and escalate assignments when necessary

Security Operations Center (SOC) Analyst

• Design the architecture of the agentic SOC
• Define data flows through detection and response pipelines
• Define agent structure, orchestration, human-in-the-loop checkpoints, and system evolution
• Write, tune, and maintain detections across the internal SIEM environment
• Establish a detection lifecycle of design, deploy, measure, tune, and improve
• Identify alert triage, investigation, and response work suitable for agent augmentation
• Build integrations, scripts, and playbooks across MSSP, EDR, SIEM, cloud infrastructure, and identity platforms
• Partner with AI Engineering to build and govern the agent stack
• Co-design MCP servers and tool integrations
• Contribute to prompt design, evaluation harnesses, and feedback loops
• Own audit trails and checkpoints for safe and accountable agent actions
• Monitor agent performance, investigate failures, tune behavior, and incorporate real-world outcomes
• Own vulnerability identification, prioritization, and remediation tracking
• Assess and improve AWS and Azure cloud security posture
• Review IAM policies, harden configurations, implement cloud-native detection, and monitor posture
• Partner on identity architecture, access reviews, privilege management, and authentication standards
• Conduct code reviews, threat models, and security assessments for internal applications and integrations
• Evaluate technologies, integrations, and infrastructure changes for security risk
• Provide pragmatic, risk-based security guidance
• Support compliance activities, evidence collection, and audit engagements
• Respond to security incidents
• Perform other related duties as assigned

Security Operations jobs in Maryland

Security Operations Center (SOC) Analyst

Senior SOC Engineer