Security Operations Analyst

Remote, United States (CT, MT, or PT timezones)

Blumira is the security operations platform built for growing teams and partners supporting them, integrating comprehensive visibility, tools, and expert guidance to give IT and security teams peace of mind from knowing they never have to go it alone. Every business needs strong security and deserves tools built for them, not just the largest enterprises. In helping them, we help their customers, and, overall, make the Internet a safer place.

Our team is passionate about putting resilience in reach for every organization and team, keeping the business running smoothly and helping teams build their own expertise through daily security practice. To realize our vision, we're looking for inquisitive and driven teammates, like you! Be part of a friendly and supportive team that embraces who you are and offers you the opportunity to help build and scale the Ann Arbor tech security scene and to learn and grow with experienced SaaS security leaders.

You will have the ability to make a big impact in the initial build of Blumira's Customer Experience (CX) organization and take Blumira to the next level!

This is a multi-functional role for someone who's passionate about helping others to protect their organization's security to the fullest extent possible. Security Operations Analysts work closely with our customers to make sure they know their security is in good hands with Blumira, through performing Security Information and Event Management (SIEM) duties, security analysis, and technical support.

• Deliver exceptional support experiences for our customers through advanced security expertise and thoughtful, empathetic communication
• Serve as a technical leader and mentor, helping guide other team members through positive influence and knowledge sharing
• Work closely with our customers to provide expert-level advisory services on complex security questions and product issues
• Lead troubleshooting efforts with customers and perform advanced log analysis to provide comprehensive context around security incidents
• Be on-call for rare critical security incidents and help lead response efforts
• Actively contribute to incident responses and help propose technical solutions
• Share your deep technical expertise across all levels of the Security Operations team, our customers, and colleagues throughout the organization
• Work closely with the Incident Detection Engineering team to triage critical and high priority security incidents
• Provide leadership and mentorship during security events
• Drive Security Operations team efficiency through process creation, optimization, and innovative feature ideas
• Work on special projects and initiatives to expand team skillsets and capabilities
• Regularly contribute to team content creation including how-to articles, documentation, and blogs
• Serve as a sought-after resource among team members for complex technical challenges
• Actively advocate for customers throughout the organization

• 3â??5 years of professional experience in a cybersecurity-focused role (SOC, Incident Response, or Security Engineering).
• Strong technical proficiency in Windows endpoint security, including a deep understanding of registry keys, file systems, and OS hardening.
• Demonstrated experience with SQL, specifically the ability to write complex queries to extract and analyze security data.
• Working knowledge of industry frameworks, such as MITRE ATT&CK, NIST, or CIS, and how to apply them to real-world threat scenarios.
• Experience with SIEM platforms (e.g., Blumira, ELK, Splunk) for log correlation and event triaging.
• Proficiency with modern support tooling, specifically Zendesk (or similar ticketing platforms) and productivity suites like Google Workspace and Slack.
• Technical Versatility:
  The ability to quickly master new, specialized software platforms and security tools as the product landscape evolves.
• Outcome-Oriented: A track record of consistently meeting or exceeding KPIs and maintaining high quality while working under SLA pressure.
• Analytical Mindset:
  Proven ability to synthesize complex technical information into clear, concise summaries for both technical and non-technical stakeholders.

• Relevant Industry
  
  Certifications:
  
  Possession of advanced security certifications such as CISSP, GCIH (GIAC Certified Incident Handler), GCFA, or Sec+.
• Networking Background:
  Previous experience in Network Administration or a deep understanding of TCP/IP, DNS, and firewall configuration to assist in troubleshooting connectivity-related security issues.
• Cloud Security Expertise:
  Familiarity with AWS, Azure, or GCP environments and their respective security logging and monitoring tools.
• Scripting Capabilities:
  Basic proficiency in Python or Power Shell to automate repetitive tasks or parse large datasets during incident investigations.
• Malware Analysis:
  Foundational knowledge of static and dynamic malware…