Senior Cyber Threat Analyst

Quadrant (Now part of Harbor IT) is a Managed Detection and Response provider that integrates advanced security technologies with top-tier cybersecurity talent to create a comprehensive solution. Focused on safeguarding customer environments, Quadrant delivers a secure approach with a commitment to keeping clients protected. Combining expertise, innovation, and care, Quadrant ensures consistent security through a dedicated team and robust technology.

Position Summary

We are seeking an experienced SOC practitioner who independently investigates complex

security events, guides incidents through the response lifecycle, and communicates clearly with both

technical and non-technical client stakeholders. This role serves as the first point of escalation for junior

analysts who need a second set of eyes, assistance with analysis, or guidance on alert tuning, documentation, and response decisions.

The ideal candidate combines deep knowledge of networking, common attack techniques, security telemetry, and remediation practices with the professionalism to explain risks, findings, and recommended actions to clients.

The role reports to the SOC Manager and partners closely with SOC analysts, engineering, security

operations, reporting teams, and client contacts.

The salary range for this role is $75,000 - $85,000

Key Responsibilities

• Monitor, triage, investigate, and resolve security events and incidents.

• Perform advanced analysis across SIEM, EDR, IDS/IPS, firewall, DNS, identity, cloud, operating system,

application, and database telemetry.

• Support incidents through the full incident response lifecycle, including preparation, identification, analysis, containment, eradication, recovery, and post-incident improvement.

• Correlate network, endpoint, identity, and log evidence to determine attack scope, impact, root cause, and recommended remediation.

• Recognize common attack techniques and provide practical containment and remediation guidance

appropriate to the affected environment.

• Serve as the first escalation point for junior analysts, providing a second review of investigations, validating conclusions, and coaching analysts through complex decisions.

• Advise on alert tuning, detection quality, false-positive reduction, rule logic, thresholds, suppression

criteria, and documentation improvements with the Detection Engineering Team.

• Communicate directly and professionally with clients by telephone, email, and meetings, clearly

explaining security findings, risk, business impact, response options, and next steps.

• Escalate high-severity or high-impact incidents according to process and exercise sound judgment and instinct.

• Create and improve investigation notes, client-facing incident communications, detection logic,

procedures, and knowledge-base content.

• Remain current on threat actor behavior, vulnerabilities, exploits, defensive techniques, and relevant

changes in the threat landscape.

• Participate in a rotating on-call schedule of two weeks on call followed by four weeks off. (Note: Extra Compensation provided during the on-call duration)

• Serve as a voice of authority during the SOC Manager’s absence.

Required Qualifications

• 3+ years of relevant cybersecurity experience, including hands-on experience in a SOC, incident response, threat detection, managed security, or closely related operational role.

• Deep familiarity with networking fundamentals and traffic analysis, including TCP/IP, DNS, HTTP/S,

routing, subnetting, public and private addressing, NAT/SNAT/DNAT, common ports and protocols, and

packet-level investigation.

• Deep familiarity with common cyberattacks, attacker techniques, indicators of compromise, likely impact, and effective containment, eradication, recovery, and remediation steps.

• Deep familiarity with incident response lifecycles and the ability to apply them consistently during real-world investigations.

• Advanced experience analyzing security logs and network traffic from diverse sources and distinguishing malicious activity from benign anomalies.

• Strong working knowledge of Windows, Linux, Active Directory, authentication activity, endpoint telemetry, and cloud security concepts.

• Experience with SIEM platforms, IDS/IPS technologies, EDR tools, packet analysis tools, vulnerability

information, and case management workflows.

• Ability to interpret and preferably develop or tune detection content, such as Snort, Suricata, SIEM queries, vendor rules, or alert logic.

• Excellent written and verbal communication skills, including the ability to speak confidently and eloquently with clients about technical security topics, risk, and remediation.

• Demonstrated ability to mentor analysts, provide constructive review, and make defensible decisions

under time pressure with minimal supervision.

• Ability to work Monday – Friday 9 am – 6 pm ET and participate in the rotating on-call schedule.

• U.S. citizenship. Harbor IT is unable to provide visa sponsorship for this role.

Preferred Qualifications

• Experience in a managed security service provider or multi-client SOC environment.

• Hands-on threat hunting, malware triage, digital forensics, cloud investigation, or detection engineering

experience.

• Practical scripting or automation experience with Python, PowerShell, Bash, or similar languages.

• Familiarity with CLI. Linux especially. Grep, sed, awk, jq, etc.

• Experience with AWS and cloud-native security telemetry.

• Relevant certifications such as BTL2, GCIH, GCIA, GCFA, CySA+, CISSP, or comparable experience. We understand that Certs aren't everything.

• A demonstrated commitment to continuous learning through labs, research, technical writing, community involvement, or independent projects.

Tools and Technologies

• SIEM and log analysis platforms; IDS/IPS and packet inspection technologies

• Snort, Suricata, Wireshark.

• EDRs such as SentinelOne, Crowdstrike, and Microsoft Defender for Endpoint

• Linux CLI; Windows; Active Directory; AWS

• Firewalls, DNS, endpoint and identity telemetry, vulnerability data, and OSINT resources

• Bash, PowerShell, Python, or other scripting and automation tools (basic level)

What Success looks like in This Role

• Gives clients clear, actionable guidance while representing Harbor IT with confidence and

professionalism.

• Improves analyst decision quality by providing accessible escalation support and thoughtful coaching.

• Identifies opportunities to tune detections, strengthen documentation, and improve SOC efficiency

without reducing security coverage.

• The Secret Word is "haversine"

• Exercises ownership, sound judgment, attention to detail, and consistent follow-through during routine

and high-pressure situations.

What We Provide

• Clear performance metrics and opportunities to influence how the SOC operates

• Unlimited PTO

• 100% employer-paid employee benefits, with additional premium selections available

• 401(k) matching

• Reimbursement for approved tuition, certifications, conference attendance, and related professional

development

• Harbor IT-approved holidays, when applicable

• A culture that supports employees in putting family first

Training and Schedule

Initial training may last up to eight weeks. Because the SOC operates 24/7/365, schedule flexibility may

occasionally be required to support coverage, training, or critical incidents.

Equal Opportunity

Harbor IT Information Security is committed to building a collaborative workplace and considers qualified

applicants based on job-related skills, experience, and business needs

To be considered for this role, please message me (Andy McCreary) a brief description of your experience, and one thing you've learned thus far this year that has been beneficial to you.