Senior Corporate Security Analyst

Responsibilities

• Corp Sec is transitioning and growing at Clio, into a focused mission-driven function within the organization. Security systems and practices are already in place, this role will be responsible for adopting and unifying the systems, communication, and oversight of security systems from across IT Systems, Application Security, and Compliance
• Build upon the existing trust within the organization, define a unified approach, configure, formalize the program in accordance to Compliance requirements
• Your team will work closely with the IT Systems, Application Security, People, Compliance, and IT Services teams to ensure appropriate security coverage in detection, response, and establishing non-adversarial techniques
• This role is established for the purpose of driving the cybersecurity definitions and posture across our fleet and systems — leading investigations, owning incident response end-to-end, and improving the operational quality of how we detect and respond to threats
• You will protect Clio from internal and external threats, accidental and intentional
• As Senior Corp Sec Analyst, you are both a senior operator and a project lead. You own detection and response work end-to-end, lead high-severity incidents, and raise the quality and velocity of how the team operates
• You stay hands-on with the tools that matter — DLP, EDR, phishing, SIEM, SSO — and you turn ambiguous patterns into runbooks, automations, and durable improvements
• The successful candidate is a force-multiplier. They recognize the importance of resolving incidents and closing tickets, they are also the person within the team that makes the teams an processes around them better
• You coach junior analysts, lead high-severity investigations, and partner with adjacent teams to close gaps that no single team owns
• Familiarity and proficiency with AI tooling is expected; you will help define how we use it in detection and response responsibly
• Where there may be a built up pain tolerance to inefficiencies or legacy processes, you learn to understand them and propose updates or rewrites when the base objective is no longer being met
• Build & Run — Technical & Operational
• The role has senior technical expectations, including raising the operational bar of the team
• Lead investigations and incident response for medium- and high-severity security events — phishing campaigns, insider risk, compromised accounts, data-loss concerns — owning the response from triage through resolution and post-incident review
• Own detection engineering across the corporate security stack — tune DLP, EDR, phishing templates, remediations, and SSO/IdP signals; build correlation rules; reduce false-positive rates without sacrificing coverage
• Drive root-cause analysis after incidents and near-misses, then translate findings into durable runbook, control, and tooling changes
• Build and maintain automations and integrations that move work left — auto-remediation playbooks, signal enrichment, evidence collection pipelines
• Define, document, and evolve internal incident response playbooks for insider threat, compromised device, and data-loss scenarios
• Partner with the Manager, Corp Sec on tooling decisions — evaluate, configure, and operate platforms across EDR, DLP, phishing, SIEM, and SOAR
• Tune and evolve security tooling for AI detection — address risks of unauthorized data movement, agentic workflows, and the lethal trifecta
• Drive correlation and visibility capability across Clio’s security stack so detection and investigation stay timely as the company continues to grow
• Act as incident commander on high-severity events — coordinate response across respective teams, as needed; communicate clearly to stakeholders during and after
• Raise the operational bar of the team — coach junior analysts, review their investigations, share patterns and gotchas, and write documentation, scripts, and/or automations for others to learn from
• Identify operational health problems before they become incidents — propose, prioritize, and execute the work to close gaps
• Drive cross-team initiatives that no single team owns — DLP policy refinement, MDM coverage, audit log centralization, AI tooling…