What are the responsibilities and job description for the W2 contract || SOC- Incident Response position at Noblesoft Technologies?
Job Title: SOC- Incident Response
Job Location: Jersey City, NJ (Onsite from day one)
Job Duration: 6 months
Minimum years of experience required: 10 years
Type of Hire: w2 contract
Job Details
10 years of experience in SOC services including incident response, digital investigation, SOC escalation, malware analysis, or security operations.
Responsibilities
Serve as an L3 incident response specialist supporting security incidents, escalations, investigations, containment coordination, and post-incident improvement.
Work with Client SOC, infrastructure, application, IAM/PAM, cloud, network, legal, risk, and relevant third parties during security incidents.
Provide subject-matter expertise on complex or high-severity incidents while maintaining clear evidence, timelines, stakeholder updates, and recommendations.
Lead or support investigation of high-severity security incidents across endpoint, identity, network, cloud, email, application, and data environments.
Perform alert validation, scoping, timeline reconstruction, root-cause analysis, impact assessment, and evidence preservation.
Develop containment, eradication, and recovery recommendations; coordinate execution with technology owners rather than assuming infrastructure remediation ownership unless explicitly authorized.
Manage technical war-room activities, investigation workstreams, action tracking, and escalation to Customer incident command.
Prepare executive summaries, detailed investigation reports, lessons learned, and post-incident corrective-action recommendations.
Maintain incident response plans, playbooks, escalation matrices, communication templates, and evidence-handling procedures.
Coordinate with threat intelligence, threat hunting, detection engineering, vulnerability management, and external forensic providers.
Support tabletop exercises, readiness assessments, simulation exercises, and continuous improvement of incident-response processes.
Technical Requirements
Strong understanding of incident response lifecycle, cyber kill chain, MITRE ATT&CK, NIST incident-handling practices, and evidence management.
Hands-on experience investigating Windows, Linux, Active Directory, Entra ID, AWS, Azure, network, endpoint, email, and application security incidents.
Experience with SIEM platforms such as Splunk, EDR/XDR platforms, network telemetry, cloud logs, identity logs, and forensic tools.
Ability to write advanced SPL or equivalent queries for investigation, correlation, and timeline construction.
Experience analyzing phishing, account compromise, malware, ransomware, insider threat, privilege misuse, data exfiltration, web attacks, and cloud compromises.
Knowledge of memory, disk, endpoint, network, and log forensics; familiarity with malware triage and sandbox analysis.
Experience using ServiceNow or similar case-management platforms for incident workflow, evidence, status, and SLA tracking.
Strong knowledge of regulatory, audit, legal-hold, and financial-services incident-reporting considerations.
Ability to automate analysis or enrichment using Python, PowerShell, APIs, SOAR, or scripting is preferred.
Job Location: Jersey City, NJ (Onsite from day one)
Job Duration: 6 months
Minimum years of experience required: 10 years
Type of Hire: w2 contract
Job Details
10 years of experience in SOC services including incident response, digital investigation, SOC escalation, malware analysis, or security operations.
Responsibilities
Serve as an L3 incident response specialist supporting security incidents, escalations, investigations, containment coordination, and post-incident improvement.
Work with Client SOC, infrastructure, application, IAM/PAM, cloud, network, legal, risk, and relevant third parties during security incidents.
Provide subject-matter expertise on complex or high-severity incidents while maintaining clear evidence, timelines, stakeholder updates, and recommendations.
Lead or support investigation of high-severity security incidents across endpoint, identity, network, cloud, email, application, and data environments.
Perform alert validation, scoping, timeline reconstruction, root-cause analysis, impact assessment, and evidence preservation.
Develop containment, eradication, and recovery recommendations; coordinate execution with technology owners rather than assuming infrastructure remediation ownership unless explicitly authorized.
Manage technical war-room activities, investigation workstreams, action tracking, and escalation to Customer incident command.
Prepare executive summaries, detailed investigation reports, lessons learned, and post-incident corrective-action recommendations.
Maintain incident response plans, playbooks, escalation matrices, communication templates, and evidence-handling procedures.
Coordinate with threat intelligence, threat hunting, detection engineering, vulnerability management, and external forensic providers.
Support tabletop exercises, readiness assessments, simulation exercises, and continuous improvement of incident-response processes.
Technical Requirements
Strong understanding of incident response lifecycle, cyber kill chain, MITRE ATT&CK, NIST incident-handling practices, and evidence management.
Hands-on experience investigating Windows, Linux, Active Directory, Entra ID, AWS, Azure, network, endpoint, email, and application security incidents.
Experience with SIEM platforms such as Splunk, EDR/XDR platforms, network telemetry, cloud logs, identity logs, and forensic tools.
Ability to write advanced SPL or equivalent queries for investigation, correlation, and timeline construction.
Experience analyzing phishing, account compromise, malware, ransomware, insider threat, privilege misuse, data exfiltration, web attacks, and cloud compromises.
Knowledge of memory, disk, endpoint, network, and log forensics; familiarity with malware triage and sandbox analysis.
Experience using ServiceNow or similar case-management platforms for incident workflow, evidence, status, and SLA tracking.
Strong knowledge of regulatory, audit, legal-hold, and financial-services incident-reporting considerations.
Ability to automate analysis or enrichment using Python, PowerShell, APIs, SOAR, or scripting is preferred.