ABOUT BLACK KITE
Black Kite is the global leader in third-party cyber risk intelligence, trusted by more than 3,000 organizations worldwide. We give security and business leaders a continuous, outside-in view of their entire vendor ecosystem — translating complex cyber, financial, and compliance signals into clear, actionable risk intelligence.
We go beyond open standards-based cyber ratings. Black Kite helps organizations make smarter risk decisions, strengthen business resilience, and scale their third-party cyber risk management programs in an increasingly complex digital environment. Our work has earned consistent recognition from customers and industry analysts alike.
WHY BLACK KITE
We’re a fast-moving, high-impact team solving one of the most critical challenges in cybersecurity today. If you’re looking to do meaningful work alongside sharp, collaborative people — and grow your career in a space that matters — you’re in the right place.
THE OPPORTUNITY
The SOC Analyst / Incident Responder is a mid-level security operations practitioner who owns their work. You will monitor and triage security events, lead incident investigations, execute response activities, and contribute to the continuous improvement of Black Kite's detection and response capability. You report to the SOC Manager and operate with meaningful autonomy on day-to-day security operations.
This is not a ticket-routing role. You bring analytical depth to alert investigations, structured thinking to escalations, and proactive energy to threat hunting. You work independently on assigned responsibilities, exercise judgment within established guidelines, and bring the SOC Manager in for decisions that warrant it — not for every event.
RESPONSIBILITIES
Security monitoring & alert triage
Monitor security events across email, endpoint, network, identity, and data loss prevention systems during assigned coverage windows
Triage incoming alerts — distinguish genuine threats from false positives, apply context, and prioritize response actions accordingly
Identify anomalous behavior patterns in log and telemetry data that may indicate threats not captured by automated detections
Maintain awareness of evolving attack techniques and apply that knowledge to daily detection and triage work
Incident response
Lead investigation and response for declared security incidents within scope — from initial detection through containment, eradication, and documentation
Execute established incident response playbooks accurately and completely; escalate to the SOC Manager when events exceed defined thresholds or require judgment outside the playbook
Coordinate with internal stakeholders — legal, operations, HR, and leadership — as appropriate during active incidents
Support threat hunting activities, proactively searching for indicators of compromise and undetected adversary activity
Conduct digital forensics analysis to support incident investigation and post-incident review
Documentation & reporting
Produce thorough, accurate incident reports documenting the full timeline, evidence chain, response actions taken, and recommendations
Present findings and case summaries to the SOC Manager and information security leadership on a routine basis
Maintain and improve incident handling procedures based on lessons learned from investigations
Research emerging threats, attack methods, and digital forensics techniques; share relevant findings with the broader security team
Security operations improvement
Identify gaps or inefficiencies in detection coverage and alert quality; bring concrete recommendations to the SOC Manager
Contribute to the refinement of playbooks, escalation criteria, and response procedures based on operational experience
Support Black Kite's security research function with technical review and proofreading of research content
WHAT YOU BRING
2–4 years of hands-on experience in security operations, incident response, or a closely related technical discipline
Solid working knowledge of incident response methodology — identification, containment, eradication, recovery, and post-incident review
Understanding of security architecture and networking fundamentals: TCP/IP, DNS, HTTP, SMTP, and common attack vectors at each layer
Working knowledge of Linux/Unix and Windows operating systems including command-line proficiency
Experience with at least one scripting language — Python or Bash — for log analysis, automation, or investigation support
Demonstrated ability to produce clear, structured incident documentation that can be read and understood by auditors and leadership
Exercises judgment within defined guidelines — knows when to act, when to escalate, and how to communicate the difference clearly
Comfortable working independently in a small, high-ownership team where initiative is expected
PREFERRED
Prior experience in a SOC, MSSP, or security operations function at a SaaS or cloud-native company
Familiarity with SIEM, DLP, endpoint detection and response, email security, or identity security platforms in an operational context
Experience with security assessment tooling — network scanners, vulnerability assessment tools, or forensics platforms
Active or in-progress certification: CompTIA CySA+, GIAC GCIH, CEH, or equivalent
Exposure to compliance-sensitive environments — FedRAMP, SOC 2, or ISO 27001 — where incident documentation quality has audit implications
The expected base salary range for this role is $85,000-95,000 per year. Compensation at Black Kite is more than just base pay — we offer a total rewards program that includes performance-based bonuses, equity, flexible healthcare options, paid time off, and retirement savings programs. The annual base salary range for this position represents a nationwide market range and reflects a broad spectrum of salaries for this role across the United States. Actual compensation will depend on factors such as qualifications, skills, experience, and the scope, complexity, and location of the role.