Security Operations Center Analyst

Make Your Mark:
Reporting to the Senior Director of Information Security, the Security Operations Center (SOC) Analyst will play a vital frontline role in monitoring, detecting, analyzing, and responding to cyber threats and security incidents across BlackLine. In this role, you will participate in operational shift/on-call coverage, monitor and triage security alert queues, investigate potential security events, execute incident containment procedures, assist with vulnerability management workflows, collaborate with cross-functional engineering and IT teams, and contribute to the continuous enhancement of BlackLine’s enterprise security posture.

You'll Get To:

- Participate in a 'follow-the-sun' operational monitoring schedule, acting as a primary responder to actively monitor, triage, and manage the real-time security alerts queue across global environments.

- Bridge the gap between detection and remediation by executing and refining standard operating procedures (SOPs), manual runbooks, and automated playbooks needed to handle threats and eliminate false positives.

- Perform initial triage, scoping, and deep-dive investigation of security events and anomalous activities across endpoint, network, identity, and multi-cloud environments.

- Apply a research-first mindset to threat analysis and incident handling, demonstrating the critical thinking needed to independently investigate alerts, trace attack lifecycles, and evaluate new security tools.

- Operationalize detection and response workflows through scripting and security orchestration (SOAR), leveraging automation to streamline repetitive alert triage and accelerate incident containment.

- Monitor and support the day-to-day operations of key SecOps technologies, including SIEM, Endpoint Detection and Response (EDR), Data Loss Prevention (DLP), and Web Application Firewalls (WAF).

- Leverage AI and LLMs to accelerate security alert analysis, synthesize threat intelligence, automate repetitive triage tasks, and drive operational efficiency across the SOC.

- Flex into evolving security initiatives and technical projects as they arise, taking proactive ownership of tasks that support detection engineering, threat hunting, and operational readiness.

- Support vulnerability management functions by triaging vulnerability scan results, validating exploitability, and coordinating remediation tickets with system and application owners.

- Create and maintain operational shift handoffs, incident summaries, and SOC metrics, translating raw event data into clear insights required for data-driven SecOps improvements.

- Collaborate closely with senior security engineers, infrastructure teams, and IT stakeholders to escalate verified incidents and promote security awareness and best practices across BlackLine.

What You'll Bring:

- 2+ years of hands-on experience in a Security Operations Center (SOC), security monitoring, or incident response role.

- Practical experience with enterprise SIEM platforms (e.g., Splunk, Microsoft Sentinel) and EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender), with the technical curiosity to investigate alerts across multi-cloud environments (AWS, Azure).

- Strong analytical, problem-solving, and investigative skills with the ability to correlate disparate log sources, identify malicious activity, and propose effective containment actions.

- Highly disciplined and dependable in fast-paced operational environments, with strong attention to detail and sound judgment during high-priority security incidents.

- Proven ability to leverage scripting languages, such as Python, Bash, or PowerShell, to parse logs, query APIs, and automate routine security analysis tasks.

- Working knowledge of Windows and Linux/Unix operating systems, including file systems, process execution, and system event logs (Event Viewer, syslog).

- Working knowledge of network security fundamentals, including a solid understanding of the OSI model, TCP/IP, DNS, HTTP/S, common network protocols, and packet analysis tools (e.g., Wireshark).

- Advanced written and verbal communication skills, including the ability to document clear incident timelines, author thorough ticket notes, and communicate technical findings to cross-functional teams.

- Familiarity with common cyber attack vectors, MITRE ATT&CK framework, OWASP Top 10, and exploitation techniques to independently triage security findings.

We’re Even More Excited If You Have:

- Experience triaging security alerts in containerized and Kubernetes environments.

- Hands-on experience leveraging AI/LLM tools for security analysis, alert summarization, or prompt engineering in SOC workflows.

- Relevant industry certifications such as CompTIA Security+, CySA+, GIAC (GCIH, GCIA, GMON), or cloud security associate certifications (AWS, Azure).

- Familiarity with Security Orchestration, Automation, and Response (SOAR) platforms and an outside-the-box mindset for proactively optimizing SOC workflows and hunting threats.

Thrive at BlackLine Because You Are Joining:

- A technology-based company with a sense of adventure and a vision for the future. Every door at BlackLine is open. Just bring your brains, your problem-solving skills, and be part of a winning team at the world's most trusted name in Finance Automation!
- A culture that is kind, open, and accepting. It's a place where people can embrace what makes them unique, and the mix of cultural backgrounds and varying interests cultivates diverse thought and perspectives.
- A culture where BlackLiner's continued growth and learning is empowered. BlackLine offers a wide variety of professional development seminars and inclusive affinity groups to celebrate and support our diversity.

BlackLine is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity or expression, race, ethnicity, age, religious creed, national origin, physical or mental disability, ancestry, color, marital status, sexual orientation, military or veteran status, status as a victim of domestic violence, sexual assault or stalking, medical condition, genetic information, or any other protected class or category recognized by applicable equal employment opportunity or other similar laws.

BlackLine recognizes that the ways we work and the workplace itself has shifted. We innovate in a workplace that optimizes a combination of virtual and in-person interactions to maximize collaboration and nurture our culture. Candidates who live within a reasonable commute to one of our offices will work in the office at least 3 days a week.

Accommodations:

BlackLine is committed to creating an inclusive and accessible experience for all candidates. If you require a reasonable accommodation that would better enable your success during the application or interview process, please complete this form .