About the role
Build the Future with AspenView Technology Partners
At AspenView, we are passionate about transforming the way organizations approach technology. We specialize in creating high-performing, nearshore IT teams to help North American clients innovate faster and more efficiently.
As we continue to grow, we’re looking for exceptional people to join our team and help drive impactful change across industries.
Why Join AspenView?
At AspenView, we’re more than a nearshore IT partner—we’re a people-first, purpose-driven company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.
Here’s what you can expect: • Competitive base • Flexible work model: hybrid, remote, or in-office • Real growth opportunities and leadership visibility • Inclusive, respectful culture that blends U.S. innovation with Colombian heart • A company that listens, invests in you, and celebrates wins together
About the Role
AspenView is building a dedicated, 24/7 Security Operations Center team for a large U.S. consumer lender in the financial services sector, and we are hiring at three levels: Tier 1 Monitoring Analysts (junior), Tier 2 Analysts and Shift Leads (mid-level), and Tier 3 Senior SOC Analysts (senior). All roles are full-time, 100% on-site in Bogotá or Buenos Aires, and dedicated to a single client, working on U.S. Eastern Time. You will be a direct AspenView employee, and the client’s security operations team directs the day-to-day work.
Alerts arrive in ServiceNow already enriched. Tier 1 validates, classifies and escalates them following the runbook; Tier 2 decides which escalations are real and owns them through to client notification; Tier 3 takes every P1, major incident and Tier 2 request for support, scoping the impact, building the timeline, recommending containment and performing first-response forensics. Incident declaration and containment execution sit with the client; the team escalates with evidence and a recommendation.
The team is built for round-the-clock coverage across two mirrored offices. Tier 1 analysts cover three rotating 8-hour shifts (07:00–15:00, 15:00–23:00 and 23:00–07:00 Bogotá time, two hours later in Buenos Aires) seven days a week, including nights, weekends and public holidays. Both offices staff the day shift every day, while evenings, nights and weekends swap between Bogotá and Buenos Aires every two weeks, so nobody works permanent nights. Tier 2 analysts rotate across the day and evening shifts and share the overnight on-call. Two Tier 3 seniors, one in each office, work business hours and share a 24/7 on-call rotation. All analysts report to the on-site SOC Manager and work from AspenView’s access-controlled offices, which operate under a clean-desk rule with VDI-only access to the client’s environment and tooling. Access to the client environment requires identity, criminal-background, employment and education checks, repeated periodically.
Tier 1 to Tier 3 is a defined career path, and detection engineering and threat hunting sit within the same team.
What You Will Do
Tier 1 – Monitoring • Own the live alert queue: acknowledgement, validation, classification and prioritization against the agreed severity matrix. • Check enrichment and pull additional context from Elastic, CrowdStrike, Microsoft Defender and Okta before making a call, and work runbooks for common alert types such as reported phishing, malware detections, risky or impossible-travel sign-ins and policy violations. • Deliver clean escalations to the Tier 2 shift lead, keep audit-ready ServiceNow ticket records, and write shift handovers covering open cases. • Serve as the only analyst on the console during night shifts, with Tier 2 and Tier 3 on call, and judge when to wake them.
Tier 2 – Shift Lead • Run the day or evening shift: who is working what, what is open, and a written handover the next shift acknowledges before you leave. • Own every escalation raised on your shift, from investigation through to client notification, plus overnight escalations when on call. • Investigate validated or ambiguous alerts, correlating Elastic, CrowdStrike, Microsoft Defender, Okta and AWS logs to reach a call you can defend, and document hypothesis, evidence, reasoning and disposition in ServiceNow. • Escalate to Tier 3 with scope, evidence and a working hypothesis, coach Tier 1 analysts and review their escalations, and provide tuning feedback to Detection Engineering on noisy or missed rules.
Tier 3 – Senior Analyst • Own P1 cases, major incidents and Tier 2 requests for support: scoping what is affected, building the timeline, and giving the client the evidence it needs to decide whether to declare an incident. • Represent the team on the client’s incident bridge and write evidence-backed containment recommendations for the client’s teams to execute. • Perform first-response DFIR: endpoint triage in CrowdStrike and Microsoft Defender, memory and disk artifacts, Okta session analysis and AWS log review, with evidence preserved properly, working across Abstract Security, Elastic and ServiceNow. • Hold escalation authority over Tier 2, review and coach their work, produce incident write-ups for the client’s security leadership, and feed detection gaps back to Detection Engineering.
What You Bring
Education • Bachelor’s degree in Cybersecurity, Computer Science, Information Systems or a related field, or equivalent hands-on experience (all levels).
Experience • All levels: Willingness to work on-site and to work the shift or on-call pattern for your level. • Tier 1: 1+ year of hands-on exposure to security monitoring through a SOC, a NOC with security duties, or a serious lab or CTF record. • Tier 2: 2.5+ years of SOC or security investigation work beyond triage, having closed incidents rather than only escalated them, plus experience leading a shift or owning escalations end to end. • Tier 3: 4+ years as a senior SOC analyst or incident responder, leading incidents yourself, with one you can walk through end to end, and the judgment to recommend containment that stops an attacker without breaking the systems the business runs on.
English • Tier 1 and Tier 2: B1 or above, strong enough to write clear escalations and talk them through with a U.S. security team. • Tier 3: Fluent (B2/C1), strong enough to hold up on an incident bridge with a U.S. security team at any hour and write the report afterwards.
Technical Expertise • Tier 1: Log fundamentals (reading Windows events, authentication logs and proxy logs) and triage discipline: following a runbook exactly and noticing when an alert does not fit it. • Tier 2: Querying logs directly in a SIEM (Elastic, Splunk, Microsoft Sentinel, QRadar or equivalent), joining evidence across endpoint, identity and cloud sources, and solid fundamentals in Windows event logs, SSO and MFA flows, and phishing and malware patterns mapped to MITRE ATT&CK. • Tier 3: Investigation in a production SIEM or log platform, writing your own queries, and working knowledge of Windows, Linux and identity attack paths (credential theft, session and token abuse, lateral movement, privilege escalation) mapped to MITRE ATT&CK.
Certifications • Tier 1: Security+, CySA+, SC-200, BTL1, CCNA CyberOps or similar (preferred). • Tier 2: CySA+, GCIA, GCIH, BTL1, SC-200 or Security+ (preferred). • Tier 3: GCIH, GCFA, GCIA, CySA+, BTL2 or OSCP (preferred).
Nice to Have • Elastic query languages (EQL, ES|QL, KQL), Abstract Security, ServiceNow or ServiceNow SecOps. • EDR consoles such as CrowdStrike Falcon, Microsoft Defender or SentinelOne. • Identity and cloud investigation in Okta or Entra ID and AWS (CloudTrail, GuardDuty, VPC flow logs) or Azure equivalents. • Email and network evidence from Proofpoint and Palo Alto, or equivalents. • Basic scripting (Python, PowerShell), SOAR playbooks, or GenAI-assisted triage tools and knowing when not to trust them. • Forensic tooling (Velociraptor, KAPE, Volatility, Autopsy) and malware triage or basic reverse engineering (Tier 3). • Experience in banking, payments or another regulated sector, ideally with a feel for PCI DSS, GLBA or NYDFS evidence expectations. • Spanish, since both offices are bilingual.
Visa Sponsorship
AspenView does not sponsor employment visas for this role. Applicants must be permanently authorized to work in their country of residence and must not require visa sponsorship now or in the future.
Equal Opportunity Employer
AspenView is proud to be an equal opportunity employer. We believe in creating an environment where all employees feel welcome, valued, and empowered to succeed. We celebrate diversity and strive to build a culture of inclusion where all individuals, regardless of their race, color, gender, gender identity or expression, sexual orientation, disability, age, or any other characteristic, can thrive. We encourage applicants from all walks of life to join our team and make a lasting impact.
Text as published by Aspenview Technology Partners. We don't edit postings; apply and ask questions on the employer's site.