We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, culture and talent experience and our ability to be compelling to our clients. You’ll find an environment that inspires and empowers you to thrive both personally and professionally. There’s no one like you and that’s why there’s nowhere like RSM.

As a Senior SOC Analyst within RSM Defense, you own high-severity security investigations and help guide the SOC’s technical direction across a growing managed security services environment supporting diverse client organizations. You will lead end-to-end incident analysis, validate adversary behavior, and translate evidence into clear containment and remediation guidance tailored to each client’s environment and risk context. You will also influence detection engineering and response automation by identifying content gaps, validating improvements against live telemetry, and converting operational lessons learned into durable, repeatable change.

The SOC operates on an integrated detection and response model across endpoint, identity, cloud, and network telemetry, supported by AI-assisted analysis and automation to reduce repetitive triage and maximize analyst focus on complex tradecraft, proactive improvements, and mentorship.

Key Responsibilities:

Advanced Investigation, Incident Handling & Incident Response

Lead complex, high-severity investigations across endpoint, network, cloud, and identity telemetry.
Perform root cause analysis and reconstruct incident timelines using aligned MITRE ATT&CK mapping.
Serve as the primary technical liaison during escalated incidents, delivering clear findings and remediation steps to internal leadership and clients.
Drive the creation of After-Action Reports (AARs) and lessons learned to improve tooling, detections, and workflow performance.

Detection Engineering & Content Support

Identify detection gaps and collaborate with Detection Engineering to develop, refine, and tune detection content across relevant telemetry sources.
Validate new detections before SOC deployment and provide measurable feedback based on production telemetry.

SOAR Automation & Workflow Optimization

Leverage SOAR platforms to automate enrichment, triage, and response actions.
Identify repetitive patterns ideal for automation and propose workflow enhancements to reduce MTTR.

Key Responsibilities:

Advanced Investigation, Incident Handling & Incident Response

Lead complex, high-severity investigations across endpoint, network, cloud, and identity telemetry.
Perform root cause analysis and reconstruct incident timelines using aligned MITRE ATT&CK mapping.
Serve as the primary technical liaison during escalated incidents, delivering clear findings and remediation steps to internal leadership and clients.
Drive the creation of After-Action Reports (AARs) and lessons learned to improve tooling, detections, and workflow performance.

Detection Engineering & Content Support

Identify detection gaps and collaborate with Detection Engineering to develop, refine, and tune detection content across relevant telemetry sources.
Validate new detections before SOC deployment and provide measurable feedback based on production telemetry.

SOAR Automation & Workflow Optimization

Leverage SOAR platforms to automate enrichment, triage, and response actions.
Identify repetitive patterns ideal for automation and propose workflow enhancements to reduce MTTR.

Senior Threat Hunter

Senior Threat Hunter

RSM

RSM

Benefits

RSM