Senior Cyber Defense Operations Analyst

# Senior Cyber Defense Operations Analyst Epic Games  
· epicgames.dev Category:
Detection & Response

Location:

Cary,North Carolina,United States
· Vancouver,British Columbia,Canada
· Montreal,Quebec,Canada Level:
Senior## Quality of life

What the posting states. Hover or tap a perk to see the line it came from.
* Unlimited PTO
* Retirement match
* 100% health premiums covered WHAT MAKES US EPIC?

At the core of Epic’s success are talented, passionate people. Epic prides itself on creating a collaborative, welcoming, and creative environment. Whether it’s building award-winning games or crafting engine technology that enables others to make visually stunning interactive experiences, we’re always innovating.

Being Epic means being a part of a team that continually strives to do right by our community and users. We’re constantly innovating to raise the bar of engine and game development.

INFOSECWhat We DoKeep Epic’s networks, hardware, and people safe from security risks. Install security measures and operate software to protect systems and information infrastructure, including firewalls and encryption programs. Document issues as they arise and assess report any impact caused.

What You'll DoEpic's Security Operations Center protects one of the world's largest player communities, along with the people, infrastructure, and technology that support it. As a Senior CDO Analyst, you will lead investigations and incident response while helping reinvent how the SOC operates, turning repeatable analysis into automated, Al-assisted workflows so the team can focus on the threats that matter  this role, you will

Lead the triage, investigation, and response for security alerts and incidents across cloud, corporate, endpoint, identity, and production environments

Act as an escalation point and incident lead, coordinating with engineering, legal, privacy, and business partners through containment, remediation, and post-incident review

Drive the detection lifecycle management, developing, tuning, and retiring detection logic to maximize signal-to-noise ratio, minimize alert fatigue, and close emerging threat gaps Identify recurring analyst work and partner with security engineering to automate it, including Al-agent workflows with clear validation and human review where it counts

Turn threat intelligence and emerging vulnerabilities into rapid exposure assessments and actionable response across the company

Develop and maintain playbooks, runbooks, and operational metrics that make the SOC faster, more consistent, and easier to scale

Set and elevate standards for investigation quality and case documentation, actively coaching analysts and holding managed-service partners accountable to rigorous SLAs and analytical depth

What we're looking for5+ years of experience in security operations, incident response, or threat detection, including leading investigations end-to-endDeep hands-on experience with SIEM and EDR platforms (e.g., Splunk, Google Sec Ops, Crowd Strike NGSIEM, etc.) and writing effective queries and detections

Strong understanding of attacker tradecraft and frameworks such as MITRE ATT CK, with the ability to reconstruct activity from logs and telemetry

Experience investigating in cloud environments (AWS and/or GCP), SaaS, and identity platforms Scripting or programming skills (Python or similar) and a drive to automate repetitive work; SOAR experience is a plus Curiosity about Al and emerging technology, and interest in applying them to security operations responsibly

Calm, decisive judgment under pressure, with the ability to prioritize competing incidents and communicate clearly to technical and executive audiences

Strong written communication, with a high standard for incident documentation and reportingA…