Security Operations Center Analyst (Evening)

Part-time, remote, $20-25/hr (without undergraduate degree) / $25 to $35 per hour (with undergraduate degree), 30 hours a week with health insurance. Evening shifts between 9:00 p.m. and 3:00 a.m. Central. Start immediately. Cyber 429 runs a 24/7 Security Operations Center for colleges, universities, and small and mid-sized organizations the big security firms price out. We are hiring Tier 1 SOC Analysts to cover the evening hours after our US day team signs off and before our European analysts come online. You will be the person watching our clients' environments when almost nobody else is. What you will do Monitor security alerts in our managed SIEM, Microsoft Defender, and Microsoft Sentinel Triage each alert against our playbooks: validate it, correlate it, and classify it as true positive, false positive, or escalate Document every alert in a ticket with your notes, actions, and disposition Escalate P1 and P2 alerts to the on-call Tier 2 analyst by phone within playbook time limits Monitor each client's emergency Teams channel and acknowledge any message within 10 minutes Take only authorized containment actions, log each one, and escalate anything beyond that scope Hand off at end of shift with a written turnover record You will not do incident response, forensics, breach determination, or direct client advisory work. Knowing where that line is matters as much as the triage. What you bring Working knowledge of security fundamentals: common attack techniques, phishing and identity compromise, endpoint malware behavior, how to read an alert Hands-on time in at least one EDR, SIEM, or identity protection console (lab, classroom, home lab, or internship counts) Clear written communication; your notes get read at 2:00 a.m. by Tier 2 and the next morning by a client Reliability on a fixed evening schedule; an unmanned shift is the one thing this role cannot absorb Judgment to escalate early rather than sit on something you are unsure about A quiet workspace, reliable high-speed internet, and a phone you can be reached on throughout the shift Authorization to work in the United States Preferred: Security+, Google Cybersecurity Certificate, Microsoft SC-200, or equivalent; experience with Huntress, Defender, or Sentinel; prior SOC, help desk, NOC, or student SOC experience; current student or recent graduate of a cybersecurity program. Schedule, pay, and benefits Evening shifts are scheduled between 9:00 p.m. and 3:00 a.m. Central, seven nights a week, shared across a team. A typical shift is four to five hours. This is a 30-hour-per-week position made up of evening shifts, standby nights (reachable by phone, paid for any time called in), and daytime SOC shifts as needed. Weekend nights rotate. Schedules are published two to four weeks ahead where operations allow. Pay is $25.00 to $35.00 per hour based on experience and certifications. Non-exempt hourly; overtime paid where the law requires. Benefits include eligibility for our health insurance plan, paid onboarding, and paid time for certification study and exams we sponsor. Analysts who want more hours are first in line for daytime shifts, Tier 2 development, and full-time openings. Location Remote, United States. Candidates in the Central time zone are preferred; candidates in other states will be considered. This position is not open to candidates who reside in or would work from Alaska, California, Colorado, Connecticut, Hawaii, Illinois, Maryland, Massachusetts, Minnesota, New Jersey, New York, Oregon, Rhode Island, Washington, or the District of Columbia. All shifts are scheduled in Central time regardless of location. Employees may not relocate to or perform work from another state without Cyber 429's prior written approval. Conditions of employment Our clients include colleges that handle student education records and financial information. Offers are conditioned on a background check (at our expense, with your consent), a signed confidentiality agreement covering FERPA-protected data, work only from a Cyber 429-managed device or virtual desktop (we provide it), named accounts with MFA, no local storage of client data, and being physically located in the United States while on shift.