SOC Analyst I / II

Note: We are hiring for this role at either the SOC Analyst I or SOC Analyst II level. The level of the offer will be based on your experience and skills, so we encourage you to apply even if you don’t meet every qualification listed for SOC II.

Company Overview 

ProCircular is a nationally recognized cybersecurity services firm built on trust, sound judgment, and long-term relationships. We work across security assessment, monitoring, incident response, advisory, AI risk, and compliance for organizations in healthcare, finance, manufacturing, education, transportation and logistics, and government, where uptime, resilience, and risk management are operational priorities. We invest in our own cybersecurity and AI research and tooling so clients benefit from what’s coming, not just what’s already widely known.

Our clients come to us for more than a toolset, a score, or a one-time deliverable. They need practitioners who can work alongside their teams to assess exposure, investigate real threats, and turn technical risk into clear action.

Position Summary

This position is responsible for conducting the technical aspects of response operations for critical events. These operations include immediate containment, investigation, and management of remediation actions, as well as enhancing defenses with the new knowledge acquired throughout the response process. This role requires the ability to develop skills on multiple security products and work closely with the staff of higher tiers, service delivery, and clients to provide ongoing communication of status and timely response to tickets.

To perform this job successfully, an individual must be able to perform each essential job function satisfactorily. The lists below represent this position's required and preferred knowledge, skill, and abilities.

Essential Job Functions (include but are not limited to the following)

• (SOC I) Review the latest alerts to determine relevancy and urgency.
• (SOC II) Respond to the latest alerts to determine relevancy and urgency.
• (SOC I) Create new trouble tickets for alerts that signal an incident and require Tier 2 / Incident Response review.
• (SOC II) Triage escalated trouble tickets for alerts that signal an incident and require Tier 3 / Incident Response review.
• (SOC I) Eyes on glass monitoring of security incidents within established customer Service Level Agreements.
• (SOC II) Monitor advanced security alerts/incidents within established customer Service Level Agreements.
• (SOC I) Assist as required in the remediation of critical information security incidents.
• (SOC II) Assist SOC Analyst I as required in the remediation of critical information security incidents.
• Review trouble tickets generated by other team members.
• Review and collect asset data (configs, running processes, etc.) on these systems for further investigation.
• First responder to security event escalations via email, phone, and ticket.
• Communicate positively with clients and escalate any issues and messages accordingly.
• Manage and monitor assigned security platforms while following established procedures.
• Complete assigned projects on time and with excellent quality.
• Practice continual self-improvement thru education, training, and certification.
• Write documentation for tasks, procedures, and knowledgebase articles needed to support the understanding and efficiency of SOC services.
• Assist with determining client needs and obtaining clarification as required to appropriately triage client requests to the appropriate resource.
• Flexible on-call as needed to support 24/7/365 security operations.
• Operate with integrity and accountability.
• Uphold the values of ProCircular and abide by the Company handbook.
• Other duties as assigned.

Position Requirements 

The requirements listed below represent the knowledge, skills, and abilities required. Applicants who do not possess the requirements for a job at the time of hire will not be considered for the position. Reasonable accommodations may be available for individuals with disabilities to perform essential functions.

Required Skills and Experience:

• Knowledge of SOC solutions (EDR, SOAR, SIEM).
• Knowledge of core security devices such as firewalls, network, and host-based intrusion detection systems, web applications, AV, WAF, Proxy, and operating system logs.
• Ability to interpret IOCs.
• Develop and maintain content and reporting.
• Technical-minded and driven.
• Experience with Windows and Linux.
• Experience with network technologies and systems, security, and network monitoring tools.
• Thorough understanding of the latest security principles, techniques, and protocols.
• Capable of working effectively independently and in a team environment
• Must be self-motivated, goal and detail-oriented
• Flexible and adaptable to changing work environment
• Ability to prioritize multiple tasks and manage time efficiently
• Must be able to use Microsoft Office Suite efficiently
• Proficient in at least one programming and scripting language (e.g., Python).
• Basic Firewall rule and policy fundamentals
• Good written and oral communication skills. Natural curiosity to get to the root cause. Ability to remain calm under pressure.
• Experience working with customers via the phone.
• (SOC II) Experience in networks communications, network/data analysis, packet capture analysis, malware detection, and custom intrusion signature development concepts

Desired Skills and Experience:

• Experience with various Cybersecurity products, but not limited to SIEM, SOAR, EDR, and XDR.
• Hands-on experience in security systems, including firewalls, intrusion detection systems, anti-virus software, authentication systems, log management, content filtering, etc.
• Experience working with internal and client ticketing and knowledge base systems for Incident and Problem Tracking, as well as procedures. (e.g., Jira, Confluence, etc.).
• Experience writing suppression and detection rules.
• Knowledge of Active Directory Environments.
• Knowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
• Knowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications.
• Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.
• Understanding various server-grade applications such as DBMS, Exchange, DNS, SMTP, IIS, Apache, SharePoint, Active Directory, Identity Management, Vulnerability\Patch Management, LDAP, SQL, and others.
• Prior experience working with container-based technologies such as Docker and Kubernetes.
• Prior consulting experience.
• (SOC II) Knowledgeable in cybersecurity analysis/operations, systems administration, information security, vendor, troubleshooting, business processes, information systems, SQL, Linux, risk management, Java, Python, PowerShell, and JSON.
• (SOC II) Knowledgeable in network security, advanced network analysis, fundamental cyber analyst/operator, network traffic analysis, information security, information systems, network troubleshooting, security operations, and cyber threat modeling
• (SOC II) Able to address incident handling (identification, overview, and preparation), buffer overflow, client attacks, covering tracks (networks, systems), denial of service attacks, incident handling (containment, eradication, recovery, and lessons learned), network attacks, password attacks, reconnaissance, scanning (discovery and mapping, techniques and defense), session hijacking and cache poisoning, methods for maintaining access, web applications attacks, worms, bots, and bot-nets
• (SOC II) Basic knowledge and understanding of addressing new attack vectors (emphasis on cloud computing technology, mobile platforms, and tablet computers), new vulnerabilities, existing threats to operating environments, advanced IDS concepts, applications protocols, concepts of TCP/IP and the link layer, DNS, fragmentation, IDS fundamentals and initial deployment (e.g., snort, Zeek), IDS rules (e.g., snort, Zeek), IPv6, network architecture and event correlation, network traffic analysis and forensics, packet engineering, SiLK and other traffic analysis tools, TCP, Tcpdump filters, UDP and ICMP, Wireshark fundamentals

Desired Education and Experience:

• Degree in Computer Science, Cybersecurity or related field or equivalent experience.
• (SOC I) 1+ years of professional experience in a Security Operations Center
• (SOC II) 2+ years of professional experience in a Security Operations Center role
• Security certifications are a plus (ex. Sec+, CySA+, GCIH, ECIH.)

Continuous Learning:

• Recommended: 40 hours annually (may include mentoring, shadowing, conferences, webinars, or rotations)

Language Requirements:

The primary language of ProCircular is English. Excellent communication skills are required, defined as the ability to:

• Actively listen for total comprehension
• Ask questions that enhance the understanding of a particular topic
• Relay information and instruction descriptively and understandably in both written and verbal format

Reasoning Ability Requirements:

High-functioning reasoning abilities are necessary to meet deadlines, prioritize company and customer needs, and work in a high-functioning collaborative team environment.

Physical Requirements:

Ability to work at a computer for extended periods (up to 8 hours a day), with or without reasonable accommodation.

Travel Requirements:

For employees based near the North Liberty, Iowa office, this position requires regular local travel, including trips to the company storage locker and other errands as assigned. Any reliable means of transportation is acceptable; a driver’s license is not required.

Employment Status

Exempt: This position is classified as exempt from overtime under the Fair Labor Standards Act (FLSA).

Schedule Expectations

Our regular hours of operation are from Monday through Friday, from 8:00 am to 5:00 pm Central Time. This position also includes flexible on-call work outside regular hours, as needed, to support 24/7/365 security operations.

Full-Time: Full-Time employees are defined legally as working at least 30 hours per week; however, full-time positions at ProCircular require at least 40 hours. This position requires 40 hours worked within a regular workweek. Occasionally, time over 40 hours may be necessary to meet the position's requirements. As long as performance expectations are met, employees may flex their schedule, subject to the preapproval of one's direct supervisor.

Candidates must be located in the United States and legally authorized to work without requiring visa sponsorship now or in the future. ProCircular is unable to provide employment sponsorship for this role.

Supervision Requirements

This position does not have supervisory responsibilities.

Performance Expectations

All teammates are evaluated at least annually on their performance based on the essential job functions in this job description, along with ProCircular's Core Values:

It's about people

• People define every part of our business. Growth potential is based on the abilities and personalities of the people involved. Technology solutions are a part of the equation, but it's the people in an organization that define its true security. We work hardest when we're supporting one another. We take care of each other; we take care of our families, and in doing so we take better care of our customers.

Fear is the mind killer

• We don't let fear define the need for our services and we don't present a problem without discussing realistic response or mitigation options. There's more than enough to worry about in life and plenty of people telling us to be afraid. We're solutions people, not fear mongers.

Strong opinions lightly held

• Opinions are important—they coalesce facts, reason, experience, and judgment into actionable points of view. We present our opinions with logic and reason rather than emotions, offering several alternatives to each challenge and the supporting data. The rejection of an idea is not a rejection of the individual or their merit. Everyone has a voice and a chance to speak, regardless of title, station or seniority.

Quality over speed, speed over cost

• Every organization must consciously balance quality, speed, and cost. We will always put the quality of our work first. We make great efforts to move quickly, but never at the expense of quality. While we strive to keep our services affordable, we never choose an inexpensive alternative that will adversely impact quality or speed.

Cool heads, warm hearts

• We keep a cool head and help others do the same, especially in a crisis. We approach adversity with patience, logic, and understanding. Mistakes happen; we don't hide, ignore, condemn, or fear them. Mistakes are opportunities to exemplify honesty, accountability, professionalism, tolerance, and grace. Instead of pointing a finger, we use humor, empathy, and fun when it matters most.

R-E-S-P-E-C-T

• We treat each other how we hope to be treated. We don't yell; we aren't condescending, and we always try to understand the other person's perspective, before reacting to it. We keep it light and we listen. We extend this principle to our customers, and we understand that talking down to them is the easiest way to send them to a competitor.

Tomorrow just happened

• Life is what happens when we're busy making other plans. We work hard on today but we're always thinking about the future. We take extra time to make sure we're learning and looking ahead. No matter what your discipline or area of expertise, you're adding your capabilities to the long-term plan for the organization and its clients.

Benefits: Full-time employees are eligible for medical, dental, and vision coverage; employer-paid basic life, AD&D, and disability insurance; voluntary life, critical illness, and accident insurance; a health savings account (HSA) or health care flexible spending account (FSA); a 401(k) retirement plan with company match; educational assistance; and adoption assistance (after 180 days of service).

Full-time employees receive 20 days (160 hours) of paid time off per year to start, increasing with years of service, plus 12 paid holidays and 3 floating holidays (including your birthday). After three years, employees may combine their PTO for an extended sabbatical.

All employees have access to an employee assistance program, caregiver support, financial wellbeing coaching, pretax commuter benefits, training and development programs, and employee discounts.

As an equal opportunity employer, ProCircular encourages an inclusive workplace where we learn from each other, live out the Company's core values, and appreciate each team member. We welcome people of different backgrounds, experiences, abilities, and perspectives. We have a responsibility to help shape a world equal for all people, and ProCircular is committed to unconditional inclusion and the celebration of diversity.  All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by law.

Offers of employment are contingent upon satisfactory completion of a background check. ProCircular will consider qualified applicants with arrest and conviction records in a manner consistent with applicable federal, state, and local laws, including fair chance hiring laws.