Remote Soar Engineer Jobs in Boca Raton, FL (NOW HIRING)

Security Operations (SOC) Analyst — Threat Hunting & AI SecOps
Location: Remote / Hybrid · Level: Mid–Senior · Reports to: SOC Lead / Head of Security

About the Role

We are seeking a SOC Analyst who goes beyond monitoring alerts. This role focuses on proactive threat hunting, end-to-end incident investigations, and building an AI-assisted SecOps capability to automate triage, enrichment, and response.

This is a hybrid role:

• 60% Security Operations (threat hunting, investigations, detection engineering)
• 40% Engineering & Automation (detection-as-code, scripting, AI-assisted tooling)

Key Responsibilities

• Conduct proactive, hypothesis-driven threat hunting across endpoint, network, identity, and cloud environments
• Lead incident investigations from alert to containment and root-cause analysis
• Develop and tune detections (Sigma, KQL, SPL, YARA) aligned with MITRE ATT&CK
• Build automation and detection workflows, including SOAR playbooks
• Contribute to AI-driven SecOps initiatives (LLM-assisted triage, enrichment, anomaly detection)
• Develop scripts (primarily Python) to automate analysis and enrichment
• Collaborate with IT and engineering teams to improve telemetry and response capabilities
• Maintain and enhance playbooks, runbooks, and SOC processes

Required Qualifications

• 3+ years of experience in SOC, Incident Response, or Threat Hunting
• Strong understanding of attacker methodologies and the MITRE ATT&CK framework
• Hands-on experience with SIEM/XDR/EDR platforms (e.g., Splunk, Microsoft Sentinel, Elastic, CrowdStrike, Defender)
• Experience writing queries and building detections
• Proficiency in Python or similar scripting language
• Solid knowledge of operating systems, networking, identity, and at least one cloud platform (AWS, Azure, or GCP)
• Strong written communication skills for incident reporting

Preferred Qualifications

• Experience with SOAR or security automation pipelines
• Exposure to AI/ML applications in cybersecurity (alert triage, anomaly detection, enrichment)
• Detection-as-code with CI/CD pipelines
• Threat intelligence experience (e.g., Pyramid of Pain)
• Certifications such as GCIA, GCFA, GCTI, OSCP, or similar

What This Role Is Not

This is not a Tier 1 monitoring role or a pure research position. It requires both strong analytical capability and hands-on building/automation skills.