2+ years of hands-on SOC / security operations experience, with ownership of investigations beyond initial triage.
A bachelor's degree in information systems, cybersecurity, or a related field, or equivalent experience.
Query proficiency on our CrowdStrike stack — CrowdStrike Query Language (CQL) — or transferable SIEM query experience (e.g., KQL, SPL)
Hands-on EDR (live response, process-tree analysis, host isolation).
Working knowledge of Windows, Linux, and Active Directory (AD) / Entra ID attack patterns
A solid grasp of the incident-response process, phishing and malware investigations; MITRE ATT&CK; for mapping observed behavior.
Cloud security monitoring (AWS, Azure, or GCP); scripting (Python or PowerShell); SOAR/automation.
Exposure to detection tuning or threat hunting.
Participate in the 24x7 rotating shift roster, including on-call and occasional weekend coverage.