SOC Specialist II - Remote job DevOps / Sysadmin at Expel

You’ve caught the security bug. Maybe it was the 18th breach-related credit-monitoring notification that sent you down a research rabbit hole. Maybe you thrive on the challenge of going head-to-head with the world’s best attackers. Or maybe you simply love computers and protecting people and just realized there’s a career that lets you do both.

One thing’s for sure: you’re ready to take the next step. You’ve read the blogs, watched tutorials, maybe even captured some network traffic in Wireshark or earned a cert. Now it’s time to put that passion into practice.

At Expel, we know that over 90% of breaches begin with phishing. That’s why our Managed Phishing service is expanding and why we’re looking for US-based analysts who want to be the first line of defense for our customers. Whether you’re breaking into security operations or growing your career as an analyst, this is your chance to investigate real threats, protect real people, and sharpen your skills alongside some of the best in the business.

• Get you out of the lab and into real networks, fighting real attackers.
• Surround you with seasoned analysts and incident responders eager to mentor and help you grow.
• Immerse you in a collaborative, encouraging, growth-minded culture.
• Give you hands-on exposure to real-world incidents, teaching you how to think like an attacker.
• Provide opportunities to expand your career into Managed Detection & Response (MDR), Customer Success, or other paths.
• Offer transparent, equitable pay, unlimited PTO (and we model actually using it), flexible work options, generous health benefits, and up to 24 weeks parental leave.

• Apply your passion for cybersecurity to spot phishing attacks and analyze suspicious emails, links, and attachments.
• Investigate alarms for potential data leaks, unauthorized account access, policy violations, and protecting data as if it were your own.
• Take ownership of alert triage from detection through remediation, providing clear, timely guidance to customers.
• Contribute to our 24x7 rotation, because attackers don’t keep office hours.
• Support a variety of operational roles in rotation, collaborating with teammates who have your back.
• Help us continually improve our defenses when you constantly experiment, refine, and innovate.

• High integrity, curiosity, flexibility, and a client-first mindset.
• Strong written communication where you can adapt your tone whether Slacking a teammate or writing a report.
• A sense of humor (bonus points for memes).
• A fundamental understanding of phishing, TCP/IP, and common protocols.
• Basic knowledge of Windows, Mac, and Linux operating systems and command line tools.
• Awareness of cloud applications (O365, Okta, etc.) and cloud infrastructure (AWS, GCP, Azure).
• Familiarity with the attack lifecycle (or kill chain, if you prefer) and MITRE ATT&CK.
• One year of IT or security experience is a plus, but if you’re motivated with a compelling story, we still want to hear from you.
• Bachelor’s degree in a technical field, or equivalent practical experience.

Compensation for this role is $65,000 USD + equity.

We believe in paying transparently and equitably. Your salary will ultimately be based on factors such as your experience, skills, team equity, and market data. You’ll also be eligible for unlimited PTO (which we model and encourage), work location flexibility, up to 24 weeks of parental leave, and really excellent health benefits.

We’re only hiring those authorized to work in the United States. We do not currently sponsor immigration visas.

We're an Equal Opportunity Employer: You'll receive consideration for employment without regard to race, sex, color, religion, sexual orientation, gender identity, national origin, protected veteran status, or on the basis of disability.

We’ll ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please let us know if you need accommodation of any kind.

#LI-Remote