SOC ANALYST I – SPLUNK/SIEM FOCUSED

The SOC Analyst I is a critical member of Boscov’s Security Operations Center (SOC), with a primary focus on advanced Splunk (SIEM) detection engineering, log analysis, and incident investigation. This role goes beyond basic alert triage, our SOC Analyst I is expected to proactively hunt for threats, engineer new detections, and drive improvements in visibility and response capabilities.
The analyst will create and optimize Splunk SPL queries, correlation rules, dashboards to detect emerging threats, while also ensuring new log sources are onboard and integrated into SOC processes. This role requires strong analytical skills to investigate complex security events, identify root causes, and provide actionable recommendations.

QUALIFICATIONS

• 2–4 years of experience in a SOC, security monitoring, or detection engineering role.
• Strong hands-on experience with Splunk, including SPL query development, alert tuning, and dashboard creation.
• Solid understanding of log analysis, SIEM tuning, and incident response workflows.
• Demonstrated ability to investigate complex security alerts and provide root cause analysis.
• Familiarity with common attack vectors (phishing, malware, lateral movement, privilege escalation).
• Strong analytical skills with attention to detail.
• Excellent communication skills for both technical and non-technical audiences.

SPLUNK / SIEM FOCUS (CORE DUTIES)

• Develop, tune, and maintain SPL queries, correlation rules, and dashboards to detect evolving threats.
• Perform deep log analysis to uncover hidden patterns, anomalies, and potential attack indicators.
• Identify gaps in visibility and work with security engineers to onboard and validate new log sources.
• Integrate Splunk detections into Jira for efficient ticketing, case tracking, and incident resolution.
• Continuously refine alerts to reduce false positives and improve detection quality.
• Map detections to MITRE ATT&CK to ensure comprehensive coverage of tactics and techniques.
• Document use cases, detection logic, and investigation steps for SOC knowledge base.