Get to know the Security Services Team
We are the team our clients trust to be their eyes and ears around the clock, watching over their environments even when their own teams are offline. Our MDR function spans real-time monitoring and alert triage, threat detection and investigation, and incident analysis and response guidance, using the EDR, SIEM, IPS, WAF, and firewall platforms deployed across our client base to catch what automated rules miss and help clients stop incidents before they become breaches.
We don't just close tickets. Our analysts tune detection logic, document what they see, and escalate with the context client stakeholders need to act fast. If you want to build deep, hands-on detection and investigation experience across a wide range of client environments, and be part of a team that backs each other up on every shift, you'll be in good company here.
The Opportunity
Workstreet is seeking a Security Operations Analyst to join our Security Services team. This is a hands-on monitoring and investigation role: you'll triage and validate alerts, lead deep investigations across EDR, firewall, IPS, WAF, and SIEM tooling, and deliver clear, actionable findings and remediation guidance across our clients' environments, with clients owning execution of the actual response.
You'll work as part of a 24x7 rotating shift schedule, partnering directly with client stakeholders to keep detection coverage strong around the clock. The successful candidate will ramp into our detection stack and client environments quickly, taking ownership of shift-level monitoring, investigation quality, and escalation judgment within their first 30 days.
What you'll do
- Execute real-time monitoring and triage - monitor alerts across EDR, firewall, IPS, WAF, and SIEM platforms, prioritizing severity and distinguishing true positives under time pressure.
- Maintain 24x7 shift coverage - deliver continuous threat monitoring as part of a rotating shift schedule including assigned nights, weekends, and holidays.
- Conduct deep incident investigations - correlate telemetry across EDR, network, and cloud log sources to determine root cause, scope, and indicators of compromise.
- Deliver remediation guidance - provide clear incident analysis and containment recommendations to client teams who own response execution within their environments.
- Tune detection logic and rules - refine SIEM correlation rules and detection logic to eliminate false positives and close security coverage gaps.
- Maintain SOC playbooks and documentation - document investigation findings and incident timelines in case management systems while updating standard operating runbooks.
- Drive cross-functional security alignment - partner with GRC engineers and vCISOs to ensure threat detection activity supports client compliance obligations.
- Support shift handoffs and mentorship - execute seamless investigation handoffs across shift rotations while guiding junior analysts on investigative techniques.
Who you are
- Experienced SOC analyst - bring 3+ years of hands-on experience monitoring, triaging, and investigating security alerts within a high-velocity SOC setting.
- Multi-platform telemetry investigator - skilled at correlating data daily across EDR, firewall, IPS, WAF, and SIEM tools to trace root causes under pressure.
- Autonomous incident owner - demonstrated ability to own complex investigations end to end and make sound escalation calls with minimal oversight.
- Clear technical communicator - able to document findings and explain complex technical incidents in plain language directly to client stakeholders.
- 24x7 rotation performer - willing and able to work a 24x7 rotating shift schedule, including nights, weekends, and holidays as assigned.
- Collaborative shift operator - thrives in fast-paced team environments, backing up colleagues across shift transitions and maintaining operational continuity.
What help you succeed
- Active security credentials - hold recognized industry designations such as CompTIA Security+, CySA+, GCIH, or equivalent credentials.
- EDR and SIEM platform mastery - practical experience with EDR tools (CrowdStrike, SentinelOne, Defender) and SIEM solutions (Splunk, Microsoft Sentinel, Sumo Logic, Wazuh).
- Tooling administration and tuning - experience configuring, maintaining, and tuning security platforms beyond day-to-day alert triage.
- SOAR and automation scripting - proficiency writing Python or PowerShell scripts and developing SOAR playbooks to automate triage workflows.
- MSSP environment background - prior experience in managed security service provider environments supporting multiple client organizations concurrently.
- Compliance framework familiarity - awareness of how SOC 2, ISO 27001, and HIPAA requirements align with threat detection and incident response operations.
What we offer
- Career Development: Clear path with mentorship and training opportunities.
- Role-Related Training: Reimbursement for the successful completion of approved training and certification courses relevant to your current role.
- Competitive Compensation: A competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.
- Growth Opportunity: Early-stage company with significant room for career advancement.
- Remote-First Culture: Flexibility to work from anywhere while collaborating with a global team, within your assigned shift.
What you'll need to thrive
- Excellent written and verbal English communication skills, with the ability to engage confidently with teammates, clients, and stakeholders across global teams.
- A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, incident calls, and uninterrupted shift coverage.
- Commitment to working your assigned shift within Workstreet's 24x7 SOC rotation, including nights, weekends, and holidays as scheduled. Occasional flexibility to adjust shifts is expected to accommodate coverage needs.
- Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities as needed.
Hiring and Selection Process
- Candidates must participate in live video interviews throughout the hiring process with camera on (non-negotiable) and be prepared to verify their identity during recruitment and onboarding.
- Employment is contingent upon successful completion of identity verification and background screening, where permitted by law.
- Selected candidates will participate in structured interviews with hiring managers and cross-functional stakeholders to assess role fit, experience, and alignment with Workstreet’s operating principles.
- Candidates will receive prompt updates and consistent communication throughout the interview process, ensuring a transparent, smooth, and engaging experience at every step.
Workstreet Is An Equal Opportunity Employer
As an equal opportunity employer, Workstreet is committed to providing employment opportunities to all individuals. All applicants for positions at Workstreet will be treated without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.