Security Operations Analyst

About this role

About Workstreet

At Workstreet, we’re on an exciting journey to help businesses scale securely by designing and implementing cutting-edge security and compliance programs. As a fast-growing startup, we specialize in a wide range of GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP. We empower companies to meet regulatory requirements and enhance their cybersecurity posture from day one.

Get to know the Security Services Team

We are the team our clients trust to be their eyes and ears around the clock, watching over their environments even when their own teams are offline. Our MDR function spans real-time monitoring and alert triage, threat detection and investigation, and incident analysis and response guidance, using the EDR, SIEM, IPS, WAF, and firewall platforms deployed across our client base to catch what automated rules miss and help clients stop incidents before they become breaches.

We don't just close tickets. Our analysts tune detection logic, document what they see, and escalate with the context client stakeholders need to act fast. If you want to build deep, hands-on detection and investigation experience across a wide range of client environments, and be part of a team that backs each other up on every shift, you'll be in good company here.

The Opportunity

Workstreet is seeking a Security Operations Analyst to join our Security Services team. This is a hands-on monitoring and investigation role: you'll triage and validate alerts, lead deep investigations across EDR, firewall, IPS, WAF, and SIEM tooling, and deliver clear, actionable findings and remediation guidance across our clients' environments, with clients owning execution of the actual response.

You'll work as part of a 24x7 rotating shift schedule, partnering directly with client stakeholders to keep detection coverage strong around the clock. The successful candidate will ramp into our detection stack and client environments quickly, taking ownership of shift-level monitoring, investigation quality, and escalation judgment within their first 30 days.

What you'll do

•
Execute real-time monitoring and triage - monitor alerts across EDR, firewall, IPS, WAF, and SIEM platforms, prioritizing severity and distinguishing true positives under time pressure.

•
Maintain 24x7 shift coverage - deliver continuous threat monitoring as part of a rotating shift schedule including assigned nights, weekends, and holidays.

•
Conduct deep incident investigations - correlate telemetry across EDR, network, and cloud log sources to determine root cause, scope, and indicators of compromise.

•
Deliver remediation guidance - provide clear incident analysis and containment recommendations to client teams who own response execution within their environments.

•
Tune detection logic and rules - refine SIEM correlation rules and detection logic to eliminate false positives and close security coverage gaps.

•
Maintain SOC playbooks and documentation - document investigation findings and incident timelines in case management systems while updating standard operating runbooks.

•
Drive cross-functional security alignment - partner with GRC engineers and vCISOs to ensure threat detection activity supports client compliance obligations.

•
Support shift handoffs and mentorship - execute seamless investigation handoffs across shift rotations while guiding junior analysts on investigative techniques.

Who you are

•
Experienced SOC analyst - bring 3+ years of hands-on experience monitoring, triaging, and investigating security alerts within a high-velocity SOC setting.

•
Multi-platform telemetry investigator - skilled at correlating data daily across EDR, firewall, IPS, WAF, and SIEM tools to trace root causes under pressure.

•
Autonomous incident owner - demonstrated ability to own complex investigations end to end and make sound escalation calls with minimal oversight.

•
Clear technical communicator - able to document findings and explain complex technical incidents in plain language directly to client stakeholders.

•
24x7 rotation performer - willing and able to work a 24x7 rotating shift schedule, including nights, weekends, and holidays as assigned.

•
Collaborative shift operator - thrives in fast-paced team environments, backing up colleagues across shift transitions and maintaining operational continuity.

What help you succeed

•
Active security credentials - hold recognized industry designations such as CompTIA Security+, CySA+, GCIH, or equivalent credentials.

•
EDR and SIEM platform mastery - practical experience with EDR tools (CrowdStrike, SentinelOne, Defender) and SIEM solutions (Splunk, Microsoft Sentinel, Sumo Logic, Wazuh).

•
Tooling administration and tuning - experience configuring, maintaining, and tuning security platforms beyond day-to-day alert triage.

•
SOAR and automation scripting - proficiency writing Python or PowerShell scripts and developing SOAR playbooks to automate triage workflows.

•
MSSP environment background - prior experience in managed security service provider environments supporting multiple client organizations concurrently.

•
Compliance framework familiarity - awareness of how SOC 2, ISO 27001, and HIPAA requirements align with threat detection and incident response operations.

What we offer

• Career Development: Clear path with mentorship and training opportunities.

• Role-Related Training: Reimbursement for the successful completion of approved training and certification courses relevant to your current role.

• Competitive Compensation: A competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.

• Growth Opportunity: Early-stage company with significant room for career advancement.

• Remote-First Culture: Flexibility to work from anywhere while collaborating with a global team, within your assigned shift.

What you'll need to…