SOC Analyst

About the role

In this role you review security alerts from endpoint, identity, email and firewall tools, investigate what is real and document incidents clearly.

This is one of the roles Velocity Technologies recruits for year-round. The job may be with Velocity, or with an organization in the Phoenix area that we recruit for. Most positions are hybrid. We confirm the employer, pay, schedule and benefits with you before any interview.

What you'll do

• Triage security alerts from endpoint, identity, email, Microsoft 365, firewall and monitoring tools.
• Investigate suspicious sign-ins, endpoint events, phishing reports and policy gaps.
• Document incident timelines, containment steps, evidence and follow-up recommendations.
• Work with systems, NOC and help desk staff on remediation and client communication.
• Improve security runbooks and alert quality.

You're probably right for this if

• You have triaged security alerts from endpoint, identity, email or cloud tools.
• You understand Microsoft 365, Entra ID, MFA, endpoint protection, logging and basic network security.
• You document carefully and handle evidence properly.
• You can explain risk without exaggerating it.

Useful but not required: MSP or MSSP experience across several client environments; Microsoft Defender, SIEM tools, phishing triage, firewall logs and incident response; Security+, CySA+ or Microsoft Security Operations Analyst. Equivalent experience counts.

Pay

$71,000 to $126,000 a year.

The hiring organization sets the exact pay within this range. Benefits depend on the employer, and we confirm them with you before any interview.

How hiring works

1. A phone call with Velocity about your experience, the role and the pay.
2. If it looks like a fit, we tell you who the employer is and confirm pay, schedule and benefits.
3. Interviews with the hiring organization, which may be Velocity.

On the first call, expect to talk through questions like these:

• How you would investigate a suspicious Microsoft 365 sign-in alert.
• What belongs in a security incident timeline.
• How you decide whether an alert needs a call to the client.