SOC Investigation Specialist Talent Network

What You'll Do6

• Review and evaluate SOC alerts and investigation outputs against predefined scenarios, separating genuine threats from false positives.
• Run end-to-end security investigations—including log analysis, entity pivoting, timeline reconstruction, and evidence correlation—when needed.
• Assess the accuracy, completeness, and quality of investigations produced by automated systems or other analysts.
• Use Splunk extensively to pivot across logs, entities, and timelines, including reading and reasoning about SPL queries.
• Produce clear, detailed documentation of investigative steps, assumptions, evidence, and conclusions.
• Collaborate with program leads and fellow annotators to maintain high standards, and mentor other analysts when serving in a lead role.

Requirements6

• 3+ years of hands-on SOC analyst experience in a production environment, ideally at Tier 2 or above.
• Strong understanding of alert triage, incident investigation workflows, and evidence-based decision-making under time pressure.
• Mandatory practical experience with Splunk, including conducting investigations, reading and reasoning about SPL queries, and pivoting across logs and timelines.
• Proven ability to evaluate SOC investigations and determine whether conclusions are valid, incomplete, or incorrect.
• Solid investigative judgment and comfort making decisive evaluations in ambiguous situations.
• Fluent English (verbal and written) with strong documentation and communication skills.

Who Should Apply

This role is for seasoned SOC analysts who thrive on dissecting alerts, validating evidence, and making tough judgment calls. You should be comfortable working independently on a remote, part-time basis and have a deep appreciation for how automation and AI can augment—but not replace—human expertise. If you're looking to apply your investigative skills to improve the next generation of security tools, this is the opportunity for you.

Salary Insight