Security Operations
SOC Analyst
The SOC Analyst reviews security signals across managed environments, investigates endpoint and identity alerts, improves detection quality, supports incident response, and documents practical client security improvements.
Role scope
What this role owns.
Help protect local clients through alert triage, endpoint review, identity signals, and practical incident readiness.
Velocity work is grounded in local managed IT delivery: Microsoft 365, Active Directory, Entra ID, Intune, SonicWall/Fortinet/Ubiquiti, backups/DR, QBRs, ticket queues, onboarding, standards alignment, and white-glove support for Phoenix and East Valley businesses.
Responsibilities
- Triage security alerts from endpoint, identity, email, Microsoft 365, firewall, and monitoring tools.
- Investigate suspicious sign-ins, endpoint events, phishing reports, policy gaps, and backup/DR implications.
- Document incident timelines, containment steps, evidence, and follow-up recommendations.
- Partner with systems, NOC, and service desk teams on remediation and client communication.
- Improve security runbooks, alert quality, and standards alignment across managed clients.
Must-have qualifications
- Security alert triage experience with endpoint, identity, email, or cloud signals.
- Understanding of Microsoft 365, Entra ID, MFA, endpoint protection, logging, and basic network security.
- Strong documentation and evidence-handling habits.
- Ability to communicate risk without exaggeration.
Nice-to-have experience
- MSP or MSSP experience supporting multiple client environments.
- Experience with Microsoft Defender, SIEM tools, phishing triage, firewall logs, and incident response.
- Exposure to backup/DR considerations during security events.
Helpful certifications
- Security+
- CySA+
- Microsoft Security Operations Analyst
- Network+
Interview stages
How we evaluate fit.
Recruiting screen
Security technical interview
Alert triage exercise
Team conversation
Hiring scorecard
What good looks like.
- Alert triage judgment
- Identity and endpoint security basics
- Incident documentation
- Risk communication
Screening questions
Questions you will see in the application.
- How would you investigate a suspicious Microsoft 365 sign-in alert?
- What should be documented during a security incident timeline?
- How do you decide whether an alert requires client communication?
Remote, relocation, and visa expectations
Unless a role explicitly states otherwise, positions are intended for candidates currently authorized to work in the United States. Relocation assistance and visa sponsorship are not assumed and will only be offered where the job posting specifically says so.
Application
Apply for SOC Analyst.
Use these fields to organize the details Velocity needs, then submit the application details or apply by email through the official company mailbox.
We do not make job offers by text message, social media DM, or personal email, and we never ask candidates to send money or purchase equipment.
Related roles