Monitor Microsoft Sentinel alerts at Office Ally, using incident triage and KQL to investigate threats across security platforms. This hands-on role includes up to 5% travel.The Security Operations Analyst serves as the first defense line for Office Ally’s security program. You will investigate incidents across endpoint, identity, email, and data protection platforms.
The role partners with security engineering, cloud infrastructure, and IT operations while maintaining compliance audit records.Key Responsibilities:
Monitor, triage, document, close, or escalate security incidentsInvestigate endpoint alerts using timelines, process trees, and file eventsRun KQL hunting queries for indicators of compromiseReview sign-in logs and Conditional Access resultsMaintain SOC runbooks and incident response proceduresRequirements:
Two or more years in SOC, IT security, or incident responseMicrosoft Sentinel and Microsoft Defender suite knowledgeAbility to read and write KQL hunting queriesActive Directory and Entra ID fundamentalsKnowledge of SOC 2, HIPAA, or HITRUST requirementsApply security operations expertise in Microsoft Sentinel, KQL hunting, identity monitoring, and incident documentation at Office Ally.