Other open roles
SOC Investigation Specialist Talent Network
Work Expert (WE) is an independent publishing and referral website. We are not a recruiter, hiring manager, agent or employer, and we are not affiliated with or endorsed by Mercor. Applying takes you to the platform's own website, where we may be recorded as the referring source. We may receive a referral fee at no additional cost to you. Read our full affiliate disclosure →
About the Role
Mercor is hiring SOC Investigation Specialist on behalf of high-growth technology and enterprise partners building next-generation SOC automation and AI-driven investigation systems. This role is ideal for experienced SOC analysts who can apply real-world investigative judgment to review, validate, and construct high-quality security investigations across SIEM, endpoint, cloud, and identity environments.
What You'll Do
- Review, monitor, and evaluate SOC alerts and investigation outputs based on predefined scenarios and criteria.
- Distinguish true positives from false positives by validating investigative evidence and alert context.
- Perform end-to-end security investigations when required, including log analysis, entity pivoting, timeline reconstruction, and evidence correlation.
- Assess the correctness, completeness, and quality of SOC investigations produced by automated or human workflows.
- Apply consistent investigative judgment while recognizing that multiple valid investigation paths may exist for the same alert.
- Make clear binary determinations (e.g., ACCEPT / PASS) while also producing detailed ground-truth investigations when required.
- Use Splunk extensively to pivot across logs, entities, and timelines, including reading and reasoning about SPL queries.
- Maintain clear and accurate documentation of investigative steps, assumptions, evidence, and conclusions.
You're a Good Fit If You
- 3+ years of hands-on experience as a SOC analyst in a production SOC environment (Tier 2 or above strongly preferred).
- Strong understanding of alert triage, incident investigation workflows, and evidence-based decision-making under time constraints.
- Mandatory hands-on experience with Splunk, including:
- Conducting investigations using Splunk
- Reading, understanding, and reasoning about SPL queries
- Pivoting between logs, entities, and timelines
- Proven ability to evaluate SOC investigations and determine whether conclusions are valid, incomplete, or incorrect.
- Strong investigative judgment and comfort making decisive evaluations.
Role Highlights
Pay & Payout
Independent contractor engagement. Apply via the link below - Mercor handles onboarding and pays weekly via Stripe or Wise.
Common Questions
Opens Mercor in a new tab. You pay nothing; we may earn a referral fee.
Get similar jobs every week
Similar roles
More model evaluation work you may qualify for.
BioInformatics Experts
Complete realistic, multi-step scientific data-analysis tasks in bioinformatics Write original bioinformatics questions where each answer is exact and objective
Atomistic Materials Modeling Expert
Mercor is recruiting Atomistic Materials Modelling Experts with strong backgrounds in computational materials science, quantum mechanical simulations, and molecular modelling to
Oncologist
Mercor is collaborating with a leading AI research lab on a project to advance frontier medical problem-solving in oncology. We are looking for oncologists based in the United