SOC Analyst (16:00–01:00 UTC)

As a SOC Analyst at Tether, you'll join our global Security Operations Center on a follow-the-sun model, working the 16:00-01:00 UTC shift. You'll monitor, triage, and investigate security events across our environment, responding to real threats and ensuring seamless handovers between regions. This role reports to the SOC Lead and demands a solid investigative mindset, hands-on platform experience, and the discipline to catch what matters.

What you'll do

• Monitor, triage, and analyze security alerts and events from SIEM, Endpoint Detection and Response (EDR), Security Service Edge (SSE), and Web Application Firewall (WAF) platforms.
• Investigate security incidents end to end, from initial triage through analysis, containment, eradication, and post-incident documentation, coordinating with relevant teams.
• Determine the scope, severity, and impact of security events, separating true positives from false positives and escalating confirmed incidents.
• Execute response actions within security platforms, such as isolating endpoints, blocking indicators, disabling compromised accounts, and enforcing access restrictions.
• Ensure structured, high-quality shift handovers across regions so that open investigations and pending actions continue seamlessly around the clock.
• Proactively threat hunt across endpoint, network, and log data to uncover suspicious activity, mapping findings to frameworks such as MITRE ATT&CK.
• Provide feedback on detection quality and contribute to tuning SIEM correlation rules, EDR custom detections, and WAF rules to reduce noise and improve coverage.
• Enrich investigations with threat intelligence, including indicators of compromise and emerging campaigns relevant to the organization.
• Develop and maintain technical documentation, standard operating procedures, and incident response playbooks.
• Collaborate with IT, infrastructure, application, and security engineering teams to resolve incidents and support operations.
• Support vulnerability management and drive continuous improvement of the organization's overall security posture.

What you bring

• A Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.
• At least 3 years of hands-on experience as a SOC Analyst, triaging alerts and investigating security incidents in a production environment.
• Solid working knowledge of EDR, SSE, SIEM, and WAF platforms, and how to use them to investigate and respond to threats.
• Experience with incident response and threat hunting, ideally with familiarity with the MITRE ATT&CK framework.
• Excellent understanding of network security, endpoint security, cloud security, and Zero Trust principles.
• Strong analytical, troubleshooting, and problem-solving skills with high attention to detail.
• Ability to handle sensitive information responsibly and securely.
• Strong written and verbal communication skills in English, and the ability to work effectively across technical and non-technical teams and across time zones.

Nice to have

• Hands-on experience implementing, configuring, and tuning security platforms, or writing and tuning detection content.
• Relevant certifications such as Security+, CySA+, GCIA, GCIH, or BTL1.

About Tether

Tether powers a global financial ecosystem built on reserve-backed tokens across blockchains. The company operates USDT, the world's most trusted stablecoin used by hundreds of millions, and runs complementary ventures including energy solutions (Tether Power), peer-to-peer technology and AI infrastructure (Tether Data), digital learning (Tether Education), and technology innovation (Tether Evolution). Tether is a fully remote, globally distributed team.