SOC Analyst

Grow with us

About this opportunity:

Ericsson Inc. does not sponsor US work authorizations for this job position including H-1B, O-1, and TN. Ericsson also does not hire F-1’s working on EAD for this position.

You need to be a US citizen and embody a merit-based, results-driven mindset, unencumbered by other topics competing for mental bandwidth. Your working hours are 10:30AM–6:30PM CT (11:30AM–7:30PM during Daylight Saving Time), and work is only done from the office. You will be required to work one weekend a month.

We are now looking for a SOC analyst in our global Cyber Defense Center (CDC).
We detect and respond to cyber attacks originating from external threat actors and ensure we are one step ahead of adversaries. Our aim is to identify their plans and means to execute them, block and disrupt their execution, and remove their presence from within Ericsson. CDC’s focus is on sophisticated antagonistic threat actors (APT’s) who can do the most harm to Ericsson as a company. Our focus is not on cyber hygiene.

The SOC provides 24/7 cyber security monitoring, triage, incident response, and detection engineering focusing on a wide range of threat actors, finding the signal in the noise and responding to the bulk of malicious activities. The SOC collaborates with the other units in the CDC:

• CDC Threat Intelligence, which compiles, analyzes and provides geopolitical and cyber threat intelligence to Ericsson and the CDC.
• CDC Incident Response and Threat Hunting, which focuses on advanced persistent threats (APTs).
• CDC AI, which ensures AI is leveraged to the fullest in automating cyber defense activities and supports security analysts, incident responders, threat hunters, etc. This unit is also specialized in incident response of AI supported and AI native attacks.
• CDC Red Team, which conducts adversary simulation assignments attacking Ericsson impersonating APT’s.
• CDC IT, which operates CDC’s dedicated IT environments and executes IT projects to ensure CDC has outstanding security monitoring coverage and data quality, and whatever IT ability is required to respond to cyber incidents.
• CDC Process & Governance, which manages CDC’s process universe, coordinates incident response, conducts vendor relationship management, etc.

What you will do

We are looking for SOC analysts who are not content with the mundane, run off the mill, ticket volume based SOC work, but instead have a burning passion to catch the bad guys and though constant innovation, constant learning, creative problem solving, and perseverance. Simply put: you want to win.
As a SOC analyst in our team you:

• Will work in a follow the sun SOC, triaging and responding to prioritized alerts, supported by the other teams in CDC. You are responsible for validating whether the alert is a true or false positive, whether it is malicious, and respond according to the response plan. You also are responsible for documenting your analysis and conclusions. Where you determine hands on keyboard activity or advanced or complex threat actor activity you escalate to the CDC incident response and threat hunting team and support them with scoping, containment and eviction
• Will increasingly work alongside agentic AI systems (commercial and in house developed) which will provide guidance and automate repetitive and mundane tasks so you can focus on the analytical part of the job instead of the pivoting and data gathering part
• Will provide ideas and concrete contributions to improve and further automate the SOC, including detection engineering, reinforcement learning, Falcon Fusion workflows and Foundry apps
• Will spend a considerable amount of time on skills development using Immersive Labs, on the job training and quality review & feedback sessions, conferences and peer interaction so you are always up to date on the threat landscape, how to deal with threats on the technologies we have

The skills you bring

• Have 4 plus years of experience with and expertise in triage, response and detection engineering in SOCs
• Have thorough knowledge of how to use EDR/ITDR/cloud security/SIEM/exposure management, etc. tooling (preferably CrowdStrike Falcon) to make quality judgements on false/true positives and malicious/non malicious
• Have general technical knowledge of a broad area of technologies such as cloud (AWS, and/or GCP and/or Azure), Linux, Windows, network, identity, etc. and have deep technical knowledge of at least one of these technologies
• Have a good understanding of threat actor TTP’s, can recognize the markings of these in telemetry and logs, and know where to look next to validate or dement whether the activity is a true or false positive, and whether it is malicious
• Have a strong ambition and drive to catch threat actors, combined with a positive can do attitude to continuously learn and improve yourself and how we work. You are never complacent
• Are stress tolerant, grounded and in control even during crisis situations when you encounter live threat actors or when attack campaigns overwhelm the SOC. You know what to do, keep your head cool, work the problem and collaborate with the team since you know we’re all in this together
• Have impeccable integrity and no urge to share confidential information to gain social status or for any other reason.

Why join Ericsson?

At Ericsson, you´ll have an outstanding opportunity. The chance to use your skills and imagination to push the boundaries of what´s possible. To build solutions never seen before to some of the world’s toughest problems. You´ll be challenged, but you won’t be alone. You´ll be joining a team of diverse innovators, all driven to go beyond the status quo to craft what comes next.

What happens once you apply?
Click Here to find all you need to know about what our typical hiring process looks like.

Ericsson uses a merit-based hiring approach that values people with different experiences, perspectives and skillsets. We truly believe this approach drives innovation, which is essential for our future growth. We encourage people from all backgrounds to apply and realize their full potential as part of our Ericsson team. Ericsson is proud to be an Equal Opportunity employer, learn more.

If you need assistance or to request an accommodation due to a disability, please contact Ericsson at hr.direct.americas@ericsson.com.

DISCLAIMER: The above statements are intended to describe the general nature and level of work being performed by employees in this position. They are not an exhaustive list of all responsibilities, duties and skills required for this position, and you may be required to perform additional job tasks as assigned.

Primary country and city: United States (US) || Plano (Country/ City)

Job details: Security Specialist

Compensation and Benefits at Ericsson
At Ericsson, we know that our people are the key to our success. We offer a competitive package to help with your individual needs and goals.

Your Pay
The salary range for this position is dependent on various factors including, but not limited to, location, and the candidate’s combination of job-related knowledge, qualifications, skills, education, training, and experience.

Short-Term Variable Compensation Plan : Your pay also includes the opportunity for an annual bonus. Actual bonus payouts are based on performance of the business against the unit’s objectives, individual performance, and the individual bonus target. Certain eligibility and pro-ration rules apply.

Sales Incentive Plan : Your pay also includes the opportunity for sales incentives as a part of Ericsson’s Sales Incentive Plan. Actual payouts are based on performance of the business against the unit’s objectives, individual performance, and the individual incentive target. Certain eligibility and pro-ration rules apply.

Your Health
Ericsson offers excellent health benefits including the choice of three medical plan options and a dental plan option that allow an employee to select the level of coverage that suits their needs. Employees will receive company credits in an amount equal to the cost that Ericsson pays toward the cost of their medical and dental premiums for themselves and eligible covered dependents.

Your Financial Security

We invest in both your short and long-term financial wellbeing. The Ericsson US 401(k) Plan offers an automatic 3% company contribution and Ericsson match $1 for every $1 you put into the 401(k) Plan on the first 3% of your eligible pay, plus 50 cents on every $1 on the next 2% of eligible pay. When you contribute at least 5% of eligible pay, you are receiving Ericsson’s full matching contributions of 4%. Matching and company automatic contributions stop when your total eligible pay for the year reaches the IRS limits. Employees will also receive company credits in an amount equal to the cost of basic life insurance and basic accidental death and dismemberment coverage, as well as short-term and long-term disability coverage. Employees also have the option to participate in Ericsson’s Stock Purchase Plan.

Your Time
Your work-life balance is important to us. New employees are provided a minimum of 15 days of accrued vacation, up to 3 personal days per year, 11 annual holidays, 8 hours of volunteer time, and 80 hours of sick time annually. Please note paid time off is pro-rated based on the employee’s start date. Furthermore, Ericsson provides up to 16 weeks of paid maternity leave and 6 weeks of parental or adoption leave at 100% of pay.

Additional Benefits
Ericsson offers many other company-paid benefits such as financial wellness programs, educational assistance, matching gifts, and recognition programs.