SOC Analyst (16:00–01:00 UTC)

As a SOC Analyst at Tether, you join a global Security Operations Center operating on a follow-the-sun model, monitoring and investigating security events across the organization's environment around the clock. You work the 16:00-01:00 UTC shift, reporting to the SOC Lead. Your focus extends beyond alert acknowledgment: you investigate suspicious activity end to end, respond to real threats, and hand over cleanly between regions so that nothing is lost across shifts.

What you'll do

• Monitor, triage, and analyze security alerts and events from SIEM, Endpoint Detection and Response (EDR), Security Service Edge (SSE), and Web Application Firewall (WAF) platforms.
• Investigate security incidents end to end, from initial triage through analysis, containment, eradication, and post-incident documentation, coordinating with relevant teams throughout.
• Determine the scope, severity, and impact of security events, separating true positives from false positives and escalating confirmed incidents according to defined procedures.
• Execute response actions within security platforms, such as isolating endpoints, blocking indicators, disabling compromised accounts, and enforcing access restrictions.
• Ensure structured, high-quality shift handovers across regions so that open investigations, ongoing incidents, and pending actions continue seamlessly around the clock.
• Proactively threat hunt across endpoint, network, and log data to uncover suspicious activity that existing detections may have missed, mapping findings to frameworks such as MITRE ATT&CK.
• Provide feedback on detection quality and contribute to the tuning of SIEM correlation rules, EDR custom detections, and WAF rules to reduce noise and improve coverage.
• Enrich investigations with threat intelligence, including indicators of compromise, attacker techniques, and emerging campaigns relevant to the organization.
• Develop and maintain technical documentation, standard operating procedures, and incident response playbooks.
• Collaborate with IT, infrastructure, application, and security engineering teams to resolve incidents and support day-to-day operations.
• Support vulnerability management and drive continuous improvement of the organization's overall security posture.

What you bring

• A Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.
• At least 3 years of hands-on experience as a SOC Analyst, triaging alerts and investigating security incidents in a production environment.
• Solid working knowledge of core security technologies such as EDR, SSE, SIEM, and WAF, and how to use them to investigate and respond to threats.
• Experience with incident response and threat hunting, ideally with familiarity with the MITRE ATT&CK framework.
• Excellent understanding of network security, endpoint security, cloud security, and Zero Trust principles.
• Strong analytical, troubleshooting, and problem-solving skills with a high attention to detail.
• Ability to handle sensitive information responsibly and securely.
• Good written and verbal communication skills in English, and the ability to work effectively across technical and non-technical teams and across time zones.

Nice to have

• Hands-on experience implementing, configuring, and tuning security platforms, or writing and tuning detection content.
• Relevant certifications such as Security+, CySA+, GCIA, GCIH, BTL1, or vendor-specific credentials.

About Tether

Tether is a fintech pioneer issuing USDT, the world's most trusted stablecoin, and operates across Tether Finance (digital asset tokenization), Tether Power (sustainable Bitcoin mining), Tether Data (peer-to-peer infrastructure and secure communication apps like KEET), Tether Education (digital learning), and Tether Evolution (emerging technologies). The team is globally distributed and fully remote.