SOC Analyst I

February 23, 2026

Other Jobs To Apply

No other job posts for this day.

The Sentinel Blue Security Operations Center (Overwatch Team) is seeking a SOC Analyst I to serve as the first line of defense against cyber adversaries, responsible for real-time monitoring, initial triage, and performing root-cause analysis of security events. Here, we do more than react. We engage. We are seeking a proactive analyst who is eager to investigate suspicious alerts, sift through the noise and correlate data, validate threats, and prioritize remediation. The ideal candidate values a desire to learn, improve, and foster team collaboration. In this role, there is opportunity for growth beyond mere ticket closure, gaining exposure and skills in other cybersecurity domains (ie. Threat Intelligence, Threat Hunting, Digital Forensics and Incident Response (DFIR), Vulnerability Management, and Detection Engineering). This is a full-time, entry-level position–perfect for recent graduates or those pivoting into cybersecurity for experience, who demonstrate a keen interest in the field. Must be open to and willing to work a shift schedule. You will be surrounded by a passionate team and culture that takes pride in our work, our core values, and a pursuit of excellence in protecting our client’s data and assets in a multi-tenant cloud environment. *This is a full-time position that is fully remote. Due to the nature of our work, you must be a U.S. citizen with eligibility for a clearance. No exceptions.* What We Can Offer: Sentinel Blue is a young company with a focused mission: we’re bringing enterprise-class cybersecurity to small and medium sized businesses. Frankly, we’re pushing the envelope of how things are done and constantly seeking innovative ways to meet that mission. The pace is fast, and we’re always learning new things. This is a great place if you want to expose yourself to new and emerging technologies, want to be challenged, and want to build your skills. Further, success in this role can quickly transition into a team leadership role. The right person will find themselves in a fun, dynamic environment, working on interesting problems and making a real difference. You will be required to achieve a Security+ certification in the first 2 months of hire; we’ll cover your certification costs and provide paid time for you to study! Requirements: <ul> <li>U.S. citizenship - by nature of our work with the defense industry, all employees must be eligible for a Secret clearance.</li> <li>Minimum of 0-2 years of experience in a Security Operations Center and/or a combination of experience in IT Support, Networking, or System Administration. </li> <li>CompTIA Security+ certification is required within the first 2 months of hire.</li> </ul> Job Duties and Responsibilities: <ul> <li>Continuously monitor the Security Information and Event Management (SIEM) dashboard and leverage security tools to detect potential security incidents and anomalies in real-time.</li> <li>Analyze incoming alerts to determine their relevance and urgency; effectively distinguish between false and true positives to prioritize response efforts.</li> <li>Conduct investigations by gathering context and other relevant logs to understand scope of alert.</li> <li>Strictly adhere to established Service Level Agreements (SLAs), Incident Response (IR) playbooks and Standard Operating Procedures (SOPs) to ensure consistent and compliant handling of security events. </li> <li>Create, update, and manage tickets in our case management system, ensuring all investigative steps, communications, and findings are thoroughly documented. </li> <li>Identify and escalate complex or high-severity incidents to Tier II or Incident Response Team, providing clear details and a comprehensive summary of initial findings. </li> <li>Perform basic remediation actions, such as blocking indicators and isolating compromised hosts, when authorized by SOPs or directed by senior personnel. </li> <li>Demonstrate excellent verbal and written communication skills, when communicating with team members, clients, and/or stakeholders.</li> <li>Contribute to the team’s knowledge base, creating or updating articles, SOPs, and/or playbooks when new trends or resolution methods are identified. </li> </ul> Knowledge and Skills: <ul><li>Log Analysis: Familiarity with and ability to parse different types of logs – identity, network, firewall, web proxy, Sysmon, Windows Events, etc. to look for Indicators of Compromise (IOCs).</li><li>Operating Systems: Familiarity with Windows, macOS, and Linux.</li><li>Phishing Analysis: Evaluate header information, authentication protocols, malicious URLs and attachments, and inspect content for signs of social engineering and/or spoofing. </li><li>Threat Enrichment: Utilize Open Source Intelligence (OSINT) tools and internal threat intel feeds to check reputation of suspicious file hashes, IP addresses, domains, and URLs. </li><li>Frameworks: Understanding of the MITRE ATT&CK Framework and Cyber Kill Chain stages. </li><li>Networking: Knowledge of common ports, OSI and TCP/IP models, key protocols (TCP/UDP, DNS, HTTP/HTTPS), network segmentation, packets, VPNs, and firewalls. </li><li>Basic Malware Analysis: Understanding of static and dynamic analysis of malicious files. </li><li>Basic Cryptography: Ability to identify type of base encoding, cipher schemes, and understanding of hashing, digital signatures, and encryption/decryption. </li><li>Reporting: Ability to explain and translate technical findings or concepts to a general audience.</li><li>Common Attacks: Ability to recognize tactics, techniques, and procedures (TTPs) of common attacks, such as credential attacks, malware, phishing, ransomware, insider threat, Denial-of-Service, code injection, etc. </li><li>Querying and Scripting: Familiarity with and ability to use querying languages (e.g. Kusto Query Language) and/or PowerShell. </li></ul> Desired Qualifications: <ul> <li>Associate’s or Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, or a related technical field.</li> <li>CompTIA Security+, GIAC Security Essentials (GSEC), Security Blue Team Level 1 (BTL1), and/ or Microsoft Security Operations Analyst (SC-200).</li> <li>Professional portfolio of projects: e.g. Github, article write-ups, home labs, etc. </li> <li>Participation in Capture-the-Flag (CTF) competitions, hackathons, bug bounties, and/or holds a high ranking on a platform (e.g. top 10% in Hack the Box).</li> </ul> Benefits: <ul> <li>Fully paid individual healthcare, vision and dental insurance for the employee.</li> <li>Paid certification and training opportunities.</li> <li>Three weeks of paid vacation + 10 paid holidays.</li> <li>A supportive environment with a focus on keeping healthy work-life balance.</li> <li>Retirement benefit (401k) with company match.</li> </ul>

Back to blog

Common Interview Questions And Answers

1. HOW DO YOU PLAN YOUR DAY?

This is what this question poses: When do you focus and start working seriously? What are the hours you work optimally? Are you a night owl? A morning bird? Remote teams can be made up of people working on different shifts and around the world, so you won't necessarily be stuck in the 9-5 schedule if it's not for you...

2. HOW DO YOU USE THE DIFFERENT COMMUNICATION TOOLS IN DIFFERENT SITUATIONS?

When you're working on a remote team, there's no way to chat in the hallway between meetings or catch up on the latest project during an office carpool. Therefore, virtual communication will be absolutely essential to get your work done...

3. WHAT IS "WORKING REMOTE" REALLY FOR YOU?

Many people want to work remotely because of the flexibility it allows. You can work anywhere and at any time of the day...

4. WHAT DO YOU NEED IN YOUR PHYSICAL WORKSPACE TO SUCCEED IN YOUR WORK?

With this question, companies are looking to see what equipment they may need to provide you with and to verify how aware you are of what remote working could mean for you physically and logistically...

5. HOW DO YOU PROCESS INFORMATION?

Several years ago, I was working in a team to plan a big event. My supervisor made us all work as a team before the big day. One of our activities has been to find out how each of us processes information...

6. HOW DO YOU MANAGE THE CALENDAR AND THE PROGRAM? WHICH APPLICATIONS / SYSTEM DO YOU USE?

Or you may receive even more specific questions, such as: What's on your calendar? Do you plan blocks of time to do certain types of work? Do you have an open calendar that everyone can see?...

7. HOW DO YOU ORGANIZE FILES, LINKS, AND TABS ON YOUR COMPUTER?

Just like your schedule, how you track files and other information is very important. After all, everything is digital!...

8. HOW TO PRIORITIZE WORK?

The day I watched Marie Forleo's film separating the important from the urgent, my life changed. Not all remote jobs start fast, but most of them are...

9. HOW DO YOU PREPARE FOR A MEETING AND PREPARE A MEETING? WHAT DO YOU SEE HAPPENING DURING THE MEETING?

Just as communication is essential when working remotely, so is organization. Because you won't have those opportunities in the elevator or a casual conversation in the lunchroom, you should take advantage of the little time you have in a video or phone conference...

10. HOW DO YOU USE TECHNOLOGY ON A DAILY BASIS, IN YOUR WORK AND FOR YOUR PLEASURE?

This is a great question because it shows your comfort level with technology, which is very important for a remote worker because you will be working with technology over time...