Cybersecurity Operations Senior Analyst

The Cybersecurity Operations Senior Analyst is responsible for security monitoring, investigations, incident response, threat analysis, detection engineering, and technical leadership within the Security Operations Center. This position serves as a senior technical resource and is expected to exercise sound technical judgment while working collaboratively with other analysts and cross-functional teams to investigate complex security events, correlate disparate enterprise data sources, identify anomalous or malicious behavior, and develop technically defensible findings and recommendations.

The Senior Analyst is expected to take ownership of assigned work, collaborate effectively with peers and subject-matter experts, contribute to team objectives, and provide technical guidance and mentorship to other analysts.

Job Duties and Responsibilities:

Monitor for Security Events & Advanced Threat Analysis - 40%
Lead advanced monitoring and analysis of enterprise security events and telemetry.

Provide timely detection, identification, investigation, and escalation of potential attacks, intrusions, anomalous activity, and misuse.

Lead proactive threat hunting based on emerging threats, adversary behaviors, organizational risk, and observed trends.

Correlate data across SIEM, EDR, identity, network, cloud, email, and other enterprise data sources to identify anomalous or malicious behavior.

Develop, validate, tune, and maintain detection rules, investigative queries, notifications, and reporting capabilities.

Evaluate detection effectiveness and recommend improvements based on investigative findings and observed behavior.

Identify telemetry, logging, and detection gaps and develop appropriate recommendations or alternative investigative approaches.

Respond to Incidents & Lead Complex Investigations - 35%
Lead complex cybersecurity investigations from initial detection through containment, remediation, recovery, and closure.

Serve as a senior incident lead and technical resource during cybersecurity incidents.

Coordinate incident-response activities across Security and partner teams.

Determine appropriate investigative approaches, data sources, technical pivots, and evidence necessary to support investigative findings.

Collaborate with analysts, infrastructure teams, application owners, and other subject-matter experts when their expertise is necessary to investigate or resolve an incident.

Provide technical support during an incident as required.

Write and distribute detailed incident reports and after-action reviews.

Identify lessons learned and recommend improvements to security controls, detections, telemetry, procedures, and response capabilities.

Produce executive-level incident summaries and communicate complex technical findings to technical and nontechnical audiences.

Security Research & Technical Leadership - 25%
Conduct enterprise-wide research into emerging threats, vulnerabilities, adversary techniques, technologies, and defensive practices.

Serve as a technical resource and escalation point for other SOC analysts.

Provide technical guidance and mentorship while promoting collaboration and shared accountability across the team.

Develop and maintain SOC playbooks, runbooks, procedures, investigative methodologies, and technical documentation.

Identify opportunities to improve SOC detection coverage, investigative capabilities, operational efficiency, and response maturity.

Lead or contribute to cross-functional cybersecurity initiatives requiring technical analysis.

Provide daily, periodic, trend, and executive-level reporting regarding security activity and/or emerging risk.

Share investigative techniques, technical knowledge, and lessons learned to improve overall team capability.

Qualifications (Education, Experience, Certifications & KSA):

Bachelor's degree in cybersecurity, information technology, computer science, or a related discipline preferred; an equivalent combination of education and relevant professional experience may be considered.
5-7 years of relevant cybersecurity experience, including experience in security operations, security investigations, incident response, or related cybersecurity functions.

Demonstrated ability to analyze complex or ambiguous technical problems, determine appropriate next steps, and work collaboratively with relevant resources toward resolution.

Demonstrated ability to correlate information from multiple security technologies and data sources to develop defensible conclusions and recommendations.

Working…