Senior SOC Analyst at Polymarket

ABOUT POLYMARKET Polymarket is the world's largest prediction market platform. We enable individuals to express views on real-world events by trading on outcomes across politics, economics, sports, culture, and current affairs. Built as a peer-to-peer marketplace with no centralized "house," Polymarket aggregates diverse opinions into transparent, market-based probabilities that reflect collective expectations about the future. We're growing fast — both in terms of volume ($21B traded in 2025) and adoption as an alternative news source. Our ambition is to become a ubiquitous beacon of truth in global media and we need your help adding fuel to the fire. ABOUT THE ROLE Polymarket is looking for a SOC Analyst to join our internal security operations team. You'll be responsible for monitoring, triaging, and responding to security events across our environment — working alongside fellow in-house analysts and coordinating with our contracted 24/7 third-party SOC provider, serving as the escalation point for confirmed or ambiguous threats that require institutional context and hands-on response. WHAT YOU'LL DO - Monitor SIEM, EDR, NDR, and cloud security tooling for alerts, anomalies, and indicators of compromise; review and triage escalations from the third-party SOC provider - Conduct proactive threat hunting using intelligence feeds, MITRE ATT&CK TTPs, and hypothesis-driven queries - Lead containment, eradication, and recovery for confirmed incidents; coordinate with Engineering, Legal, and Leadership on high-severity events - Respond to on-call pages per the team rotation schedule; write clear incident reports covering timeline, impact, root cause, and corrective actions - Analyze malware samples, phishing campaigns, network traffic, and endpoint artifacts to determine scope and attacker TTPs - Identify detection gaps and propose new SIEM rules, correlation logic, and tuning improvements - Author and maintain SOC runbooks and playbooks used by both in-house and third-party teams; contribute to weekly/monthly reporting on incident trends and third-party SLA adherence WHAT WE'RE LOOKING FOR - 2+ years of hands-on SOC, incident response, or security operations experience - Proficiency with a SIEM platform (Palo Alto XSIAM preferred) - Experience with EDR/XDR tooling (CrowdStrike, SentinelOne, or equivalent) - Demonstrated ability to triage alerts including phishing, malware, lateral movement, and credential-based attacks - Solid understanding of TCP/IP, DNS, HTTP/S, and common attack patterns - Ability to read and write basic scripts or queries (Python, Bash, KQL, or SPL) to support analysis - Availability for rotating shifts and participation in on-call rotation - (Plus) Experience managing escalations to or from an MSSP or third-party SOC - (Plus) Certifications such as CompTIA CySA+, GCIA, GCIH, or equivalent - (Plus) Familiarity with cloud security tooling in AWS, GCP, or Azure - (Plus) Knowledge of the blockchain, DeFi, or crypto-sector threat landscape - (Plus) Experience with MITRE ATT&CK-based threat hunting or purple team exercises BENEFITS - Competitive salary & equity - Unlimited PTO - Full Health, Vision, & Dental coverage - 401k match - Hardware setup: new MacBook Pro, big display, & accessories