SOC Investigation Specialist Talent Network

About this role

**Mercor is hiring SOC Investigation Specialist** on behalf of high-growth technology and enterprise partners building next-generation SOC automation and AI-driven investigation systems. This role is ideal for experienced SOC analysts who can apply real-world investigative judgment to review, validate, and construct high-quality security investigations across SIEM, endpoint, cloud, and identity environments. * * * ### Responsibilities - Review, monitor, and evaluate SOC alerts and investigation outputs based on predefined scenarios and criteria. - Distinguish true positives from false positives by validating investigative evidence and alert context. - Perform end-to-end security investigations when required, including log analysis, entity pivoting, timeline reconstruction, and evidence correlation. - Assess the correctness, completeness, and quality of SOC investigations produced by automated or human workflows. - Apply consistent investigative judgment while recognizing that multiple valid investigation paths may exist for the same alert. - Make clear binary determinations (e.g., ACCEPT / PASS) while also producing detailed ground-truth investigations when required. - Use Splunk extensively to pivot across logs, entities, and timelines, including reading and reasoning about SPL queries. - Maintain clear and accurate documentation of investigative steps, assumptions, evidence, and conclusions. - Collaborate with program leads and other expert annotators to uphold high-quality investigation and annotation standards. - Mentor or support other analysts where applicable, particularly in long-term or lead annotator roles. * * * ### Requirements - 3+ years of hands-on experience as a SOC analyst in a production SOC environment (Tier 2 or above strongly preferred). - Strong understanding of alert triage, incident investigation workflows, and evidence-based decision-making under time constraints. - Mandatory