• Execute real-time monitoring and triage - monitor alerts across EDR, firewall, IPS, WAF, and SIEM platforms, prioritizing severity and distinguishing true positives under time pressure.
• Maintain 24x7 shift coverage - deliver continuous threat monitoring as part of a rotating shift schedule including assigned nights, weekends, and holidays.
• Conduct deep incident investigations - correlate telemetry across EDR, network, and cloud log sources to determine root cause, scope, and indicators of compromise.
• Deliver remediation guidance - provide clear incident analysis and containment recommendations to client teams who own response execution within their environments.
• Tune detection logic and rules - refine SIEM correlation rules and detection logic to eliminate false positives and close security coverage gaps.
• Maintain SOC playbooks and documentation - document investigation findings and incident timelines in case management systems while updating standard operating runbooks.
• Drive cross-functional security alignment - partner with GRC engineers and vCISOs to ensure threat detection activity supports client compliance obligations.
• Support shift handoffs and mentorship - execute seamless investigation handoffs across shift rotations while guiding junior analysts on investigative techniques.

• Experienced SOC analyst - bring 3+ years of hands-on experience monitoring, triaging, and investigating security alerts within a high-velocity SOC setting.
• Multi-platform telemetry investigator - skilled at correlating data daily across EDR, firewall, IPS, WAF, and SIEM tools to trace root causes under pressure.
• Autonomous incident owner - demonstrated ability to own complex investigations end to end and make sound escalation calls with minimal oversight.
• Clear technical communicator - able to document findings and explain complex technical incidents in plain language directly to client stakeholders.
• 24x7 rotation performer - willing and able to work a 24x7 rotating shift schedule, including nights, weekends, and holidays as assigned.
• Collaborative shift operator - thrives in fast-paced team environments, backing up colleagues across shift transitions and maintaining operational continuity.

What help you succeed

• Active security credentials - hold recognized industry designations such as CompTIA Security+, CySA+, GCIH, or equivalent credentials.
• EDR and SIEM platform mastery - practical experience with EDR tools (CrowdStrike, SentinelOne, Defender) and SIEM solutions (Splunk, Microsoft Sentinel, Sumo Logic, Wazuh).
• Tooling administration and tuning - experience configuring, maintaining, and tuning security platforms beyond day-to-day alert triage.
• SOAR and automation scripting - proficiency writing Python or PowerShell scripts and developing SOAR playbooks to automate triage workflows.
• MSSP environment background - prior experience in managed security service provider environments supporting multiple client organizations concurrently.
• Compliance framework familiarity - awareness of how SOC 2, ISO 27001, and HIPAA requirements align with threat detection and incident response operations.

• Career Development: Clear path with mentorship and training opportunities.
• Role-Related Training: Reimbursement for the successful completion of approved training and certification courses relevant to your current role.
• Competitive Compensation: A competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.
• Growth Opportunity: Early-stage company with significant room for career advancement.
• Remote-First Culture: Flexibility to work from anywhere while collaborating with a global team, within your assigned shift.

What you'll need to thrive

• Excellent written and verbal English communication skills, with the ability to engage confidently with teammates, clients, and stakeholders across global teams.
• A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, incident calls, and uninterrupted shift coverage.
• Commitment to working your assigned shift within Workstreet's 24x7 SOC rotation, including nights, weekends, and holidays as scheduled. Occasional flexibility to adjust shifts is expected to accommodate coverage needs.
• Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities as needed.

Hiring and Selection Process

• Candidates must participate in live video interviews throughout the hiring process with camera on (non-negotiable) and be prepared to verify their identity during recruitment and onboarding.
• Employment is contingent upon successful completion of identity verification and background screening, where permitted by law.
• Selected candidates will participate in structured interviews with hiring managers and cross-functional stakeholders to assess role fit, experience, and alignment with Workstreet’s operating principles.
• Candidates will receive prompt updates and consistent communication throughout the interview process, ensuring a transparent, smooth, and engaging experience at every step.

About Workstreet

At Workstreet , we’re on an exciting journey to help businesses scale securely by designing and implementing cutting-edge security and compliance programs. As a fast-growing startup, we specialize in a wide range of GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP. We empower companies to meet regulatory requirements and enhance their cybersecurity posture from day one.