Threat Hunting & Security Monitoring

• Conduct proactive threat hunting across the client base rather than relying solely on inbound alerts.
• Continually monitor security intelligence and threat chatter that may affect ImageQuest clients.
• Maintain a current understanding of the threat landscape relevant to ImageQuest's client industries.

Spam Filter & Phishing Escalation

• Serve as the escalation point for Defender for Office, IronScales, and Mimecast configuration and tuning.
• Own escalated phishing investigations referred from the SOC Analysts, determining scope and whether further containment is needed.
• Adjust spam filter policy, including sender and domain blocks, allow lists, and quarantine rules, in response to confirmed phishing campaigns.
• Coordinate directly with clients on high-impact phishing incidents requiring same-day action.

Endpoint & Tooling Ownership

• Configure and maintain Microsoft Defender for Endpoint, SentinelOne, ThreatLocker, Huntress, and Arctic Wolf across the client base.
• Build deeper, custom ThreatLocker policy beyond the standard baseline maintained by the SOC Analysts, precise enough to block real threats without breaking legitimate client applications.
• Investigate tooling gaps and false positives, tuning detection rules to reduce noise reaching the Analyst queue.

Automation & Process Improvement

• Drive scripting and automation improvements across the SOC's alert and ticketing tools to reduce manual, repetitive work.
• Establish and maintain accurate documentation of SOC processes and incident responses.
• Pull monthly reports and categorize SOC activity appropriately.

Client Onboarding & Advisory Support

• Support onboarding of new clients, including deployment of security tooling and validation of SOC coverage.
• Provide technical expertise to Advisory Services during incidents, audits, and cyber insurance claims that require deep technical detail.
• Participate in cyber incident response tabletop exercises as needed.

Documentation & Communication

• Ensure all client-facing documentation is consistent with ImageQuest format and professional standards.
• Communicate technical incident details clearly to both technical and non-technical clients and internal stakeholders.
• Collaborate with the Managed IT team, including the Network Operations Center, Field Technicians, and Service Desk.
• Participate in occasional on-site client visits and off-site ImageQuest client events.

Our ideal Lead SOC Engineer has the following qualifications:

• 3+ years of proven IT security experience, with hands-on incident response or threat hunting experience.
• Bachelor's degree in computer science, information technology, or a related field desired.
• Deep working knowledge of SentinelOne, ThreatLocker, Huntress, and Arctic Wolf, or comparable EDR, application control, SIEM, and MDR platforms.
• Demonstrated ability to investigate, triage, and contain confirmed security incidents.
• Working knowledge of a scripting language (e.g., PowerShell) for automation and tooling improvements.
• Thorough understanding of networks (IP subnetting, TCP/IP, routing, VPN) and common attack vectors.
• Familiarity with common industry pentesting tools and methodology.
• Familiarity with regulatory frameworks and guidance, including NIST, CIS Controls, and ISO 27002.
• Strong analytical and problem-solving skills, with the ability to cut through noise to find the root cause and exercise sound judgment under pressure.
• Precise and detail-oriented when configuring tools that affect client production environments.
• Ability to function well in a high-paced, interrupt-driven environment and balance proactive work against active escalations.
• Strong written and verbal communication skills, with the ability to break down complex technical information for non-technical audiences.
• Proficiency with Microsoft Office (Excel, Word, PowerPoint, Outlook) and Microsoft Teams.
• Nice to have: familiarity with virtualization technologies and the Microsoft Azure Portal, experience in a managed services or consulting environment, and familiarity with SIEM platforms and vulnerability scanners.
• Recommended certifications: CompTIA Security+, Network+, or CySA+, and Microsoft SC-200 or SC-300.

This role is based in Brentwood, TN and will operate on a hybrid basis, with a base compensation range of $90,000-$95,000.

We are seeking a candidate who goes beyond alert triage. The ideal candidate will be comfortable owning incidents end-to-end, making sound decisions with incomplete information, and taking full responsibility for the quality and accuracy of the security tooling our clients depend on. This includes the ability to receive an escalation, quickly distinguish a confirmed compromise from noise, contain the threat, communicate clearly with the client, document the response thoroughly, and hand it off successfully to Advisory Services. If you are an analytical, detail-oriented security professional who enjoys bringing order out of disorder in a managed services environment, we would welcome the opportunity to speak with you.