SOC Investigation Specialist Talent Network

$70–95/hrrate as listed

Mercor is recruiting Tier 2+ SOC analysts to evaluate AI-generated security investigations and produce ground-truth cases across SIEM, endpoint, cloud, and identity data. Work is Splunk-heavy: you pivot across logs, reconstruct timelines, and make accept/reject calls on whether an investigation's conclusions hold up.

Summary, eligibility guidance and screening preparation are prepared by Sidequest from the platform's posting. Check the source listing before applying.

What the work involves

You receive alerts and the investigations attached to them — some produced by automated systems, some by other analysts — and decide whether the reasoning is sound. That means checking whether the evidence cited actually supports the verdict, whether obvious pivots were skipped, and whether a true positive was written off as noise (or the reverse). On other tasks you build the reference investigation yourself: the full triage path, the SPL you'd run, the entities you'd pivot through, the timeline, and the conclusion with its supporting evidence.

Most decisions resolve to a binary (ACCEPT / PASS), but the value is in the written rationale underneath. Reviewers want to see which specific log line or missing correlation drove your call. A recurring difficulty is that two analysts can take different valid routes to the same correct conclusion — you're judging whether an investigation is defensible, not whether it matches your personal habits.

What the platform screens for

Real production SOC time. 3+ years hands-on, Tier 2 or above strongly preferred. Expect follow-ups on shift structure, escalation paths, and cases you personally closed.
Splunk depth, not familiarity. You should be able to read SPL you didn't write, explain what a search is actually returning, and describe how you'd pivot from a single indicator to a full entity picture.
Decisiveness with a stated basis. Screens penalize hedging; they also penalize confident calls with no evidentiary reasoning behind them.
Written clarity. Documentation quality is the deliverable as much as the verdict.

Strengthening signals include EDR work (CrowdStrike, Defender for Endpoint, SentinelOne), cloud log analysis (CloudTrail, GuardDuty, Azure Activity Log, GCP Audit Logs), IAM platforms like Okta or Entra ID, email security tooling, and certifications such as GCIA, GCIH, or Splunk credentials. None are hard gates.

Logistics and pay

Fully remote and largely asynchronous, with task batches pulled from a queue rather than assigned shifts. Observed rates for this listing run $70–95/hr, typically varying with tier level, Splunk depth, and whether you take a lead-annotator or mentoring track — not guaranteed, and set per engagement. Commitments are usually part-time and flexible (often 10–20 hours weekly), with longer-running program work available to analysts who hold quality consistently. Occasional synchronous calibration sessions with program leads are common on active projects.

What they look for

3+ years hands-on SOC analyst experience in a production environment (Tier 2+)
Splunk investigation experience, including reading and reasoning about SPL
Alert triage and incident investigation workflow expertise
Ability to evaluate whether another analyst's or system's investigation is valid, incomplete, or wrong
Clear written documentation of evidence, assumptions, and conclusions in fluent English
EDR, cloud log (CloudTrail/GuardDuty/Azure/GCP), or IAM analysis experience

Before you apply

Would you pass this screen?

Drawn from what this listing actually requires. Answered in your browser — nothing is sent to us, and we do not store your answers.

Do you have at least 3 years of hands-on experience working as a SOC analyst in a production SOC environment?
3+ years SOC analyst experience · required
Have you conducted investigations using Splunk, including reading and reasoning about SPL queries and pivoting between logs and entities?
Splunk hands-on proficiency · required
Have you worked at Tier 2 or above in a SOC (conducting end-to-end investigations beyond alert triage)?
Tier 2+ SOC experience · preferred
Are you fluent in English, both written and spoken, to produce clear documentation and communicate with the team?
Fluent English (written and spoken) · required
Do you have hands-on experience with at least one EDR tool such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne?
EDR tool experience (preferred) · preferred
Do you have hands-on experience investigating security events in cloud environments such as AWS, Azure, or GCP?
Cloud security investigation experience · preferred

0 of 6 answered

Included with this listing

Interview prep — 12 questions

Matched to what this platform's screening actually measures. Answer each out loud in 60–90 seconds: claim → concrete example → implication.

What it tests: Whether candidate has genuine Tier 2+ hands-on investigation experience, not just alert monitoring; ability to articulate the chain of reasoning across multiple data sources and to distinguish signal from noise under pressure.
A strong answer: The answer names a specific alert type or scenario, describes the actual logs examined (e.g., process execution, network, authentication), shows how they pivoted between entities or timelines to build or rule out the story, and explains the decisive logic that led to their conclusion—not a guess.
Where people lose it: Describing only alert triage or escalation decisions, or giving a generic 'I looked at logs' answer without naming specific log types, fields, or the pivoting logic that validated or invalidated the alert.