Security Operations Analyst

What you'll do

• Triage and respond to security incidents across phishing, endpoints, cloud infrastructure, and SaaS applications.
• Build and optimize detection signatures, response playbooks, and automation using detection-as-code principles.
• Manage the feedback loop for detections to fine-tune alerts and reduce false positives.
• Conduct threat modeling with cross-functional partners to identify weaknesses in various environments.
• Perform threat hunting and data normalization to identify anomalous patterns and establish baselines.
• Participate in an on-call rotation to investigate security events and communicate findings to stakeholders.
• Develop Python code to automate SOC operations within a shared codebase.
• Mentor and guide junior analysts while leading large-scale data baseline projects.

What we're looking for

• Experience in security monitoring, log analysis, and detection engineering across endpoint, network, and various application sources.
• Experience in Python development for automating SOC operations within a shared codebase.
• Proficiency in one or more SIEM languages such as SPL, KQL, or SQL.
• Experience conducting analysis within a data lake environment.
• Broad practical security knowledge across endpoint, network, identity, application, and cloud infrastructure.
• Knowledge of attacker tactics, techniques, and procedures (TTPs) across Windows, Linux, MacOS, AWS, and Azure.
• Strong communication skills and experience collaborating with internal and external stakeholders.
• Must be able to obtain and hold a U.S. Top Secret security clearance.
• Experience conducting incident response in the Cloud (AWS, Azure, GCP) (preferred).
• Digital Forensics and/or reverse engineering experience (preferred).