Principal Security Operations Center Analyst

This is a fully remote position, open to applicants in Australia.

📋 Description

• Take ownership of intricate, multi-host intrusions from start to finish, encompassing triage, forensic timelining, root cause analysis, and remediation across endpoint, identity (Microsoft 365 / Google Workspace), and SIEM telemetry.

• Serve as the SOC's technical collaborator with Product, Product Research, and Detection Engineering & Threat Hunting, transforming recurring operational challenges into effective detection, suppression, and product solutions.

• Conduct advanced static and dynamic malware analysis, investigate emerging tradecraft, and disseminate findings through Huntress content.

• Identify repeatable investigation patterns and inefficiencies, then design, develop, and maintain both automated and human-led workflows in collaboration with Workflow Engine owners, Product, and Engineering, ensuring inline QC/QA.

• Ensure quality control on the floor by evaluating AI agent and analyst outputs, tracing errors to their root causes, rectifying them at the source, and serving as the final technical reviewer for detection tuning, suppression decisions, and high-impact incident reports.

• Provide technical leadership and mentorship throughout the team by establishing investigation standards, conducting case reviews, facilitating ride-alongs, leading knowledge sessions, offering SOC direction advice, and assessing candidates.

• Act as a cultural advocate for the team, promoting the mindset that “agents handle volume, humans own quality.”

• Manage threat-related escalations from SOC Support, clearly articulating complex activities and business risks to both technical and non-technical audiences.

• Collaborate closely with Product, Product Research, and Detection Engineering & Threat Hunting.

• Support the publication of research through Huntress blogs, webinars, and conference presentations.

⛳️ Requirements

• A minimum of 6 years of experience in SOC, Incident Response, DFIR, or MDR roles, including leading multi-host intrusion investigations.

• Extensive knowledge of attacker tradecraft as outlined in MITRE ATT&CK (credential access, lateral movement, persistence, defense evasion, living-off-the-land) and methods of detection.

• Profound forensic and investigative expertise across Windows, macOS, and Linux operating systems.

• Strong experience in cloud identity investigation and remediation, particularly within Microsoft 365 / Entra ID and Google Workspace.

• Advanced skills in static and dynamic malware analysis, including the ability to extract IOCs and assess capability and intent.

• Solid enterprise Windows administration skills (Active Directory, Group Policy, PowerShell, domain trusts) along with core networking knowledge.

• Hands-on proficiency with AI tools: daily utilization of tools like Claude and Codex for analysis, research, and the development of automation and agentic workflows (Python, PowerShell, or similar), with sound judgment regarding their output validation.

• Comprehension of inline quality delivery: integrating QC/QA into workflows during execution (quality gates, statistical sampling, drift detection, and regression testing) rather than relying solely on post-event reviews.

• Demonstrated technical leadership and mentorship capabilities: you have elevated the performance of a team, not just your individual contributions, and can clearly articulate complex findings in both written and verbal forms.

• Experience in publishing research, blogs, conference presentations, or developing open-source security tools.

• Background in detection engineering: crafting and fine-tuning detections and SIEM queries.

• Investigative experience with other cloud platforms such as Azure, AWS, or GCP.

• Previous experience in MSP/MSSP/MDR environments and familiarity with RMM tools.

• Individuals from all culturally diverse backgrounds, including Aboriginal & Torres Strait Islander Peoples, are encouraged to apply.

🏝️ Benefits

• Fully remote work environment.

• Opportunity for at least one annual trip to the US for the Summer Summit, in addition to local events in Australia!

• Reimbursement for new starter home office setup ($800 AUD).

• 12 weeks of paid parental leave for both primary and secondary caregivers.

• Monthly digital allowance for personal phone and internet expenses ($185 AUD).

• Monthly stipend for home office technology upgrades or replacements ($40 AUD).

• Subsidized private health insurance through our preferred provider.

• Stock options available for all full-time employees.

• Access to the BetterUp platform for coaching, personal, and professional development.