Sr Cyber Defense Ops Specialist

Description

We are seeking a skilled and proactive Level 2 Cybersecurity Analyst to join our Cyber Defense Operations team. This role is responsible for investigating and responding to security incidents, performing advanced threat analysis, and supporting the continuous improvement of detection and response capabilities. You’ll work closely with junior analysts, threat intelligence, and incident response teams to ensure timely detection and mitigation of security threats across Citizens Bank’s enterprise environment.

• Investigate escalated security alerts and incidents from Level 1 analysts.
• Perform root cause analysis and impact assessments of security events.
• Conduct threat hunting and anomaly detection across enterprise systems.
• Collaborate with incident response teams to contain and remediate threats.
• Correlate threat intelligence with internal telemetry to identify emerging threats and attack patterns.
• Assist in the creation of use cases and offer recommendations for tuning detection rules in SIEM and other monitoring tools.
• Recommend improvements to incident response playbooks and runbooks.
• Provide mentorship and guidance to Level 1 analysts.
• Participate in post-incident reviews and contribute to lessons learned.
• Represent Cyber Defense in cross-functional security and risk initiatives.

• Deep understanding of network and endpoint security concepts.
• Knowledge of threat actor tactics, techniques, and procedures (TTPs).
• Familiarity with the MITRE ATT&CK framework and threat intelligence platforms.
• Knowledge of regulatory and compliance frameworks (e.g., NIST, ISO, PCI-DSS).

• Proficient in log analysis, packet capture review, and malware analysis.
• Strong analytical and problem‑solving skills.
• Experience with scripting or automation (Python, Power Shell, Bash).
• Effective oral and written communication skills for both technical and non‑technical audiences.
• Ability to work independently and collaboratively in a high‑pressure environment.

• Bachelor’s degree in Cybersecurity, Computer Science, or a related field, or equivalent experience.
• 2–5 years of experience in cybersecurity operations or incident response.
• Security certifications such as CySA+, GCIH, GCIA, CEH, or equivalent preferred.
• Experience with SIEM platforms (e.g., Splunk, Sentinel, QRadar) and EDR tools (e.g., Crowd Strike, Microsoft Defender).
• Willingness to participate in a rotating on‑call schedule or extended hours during critical incidents.

• Hands‑on experience with:
• SIEM Tools:
  Splunk, Arc Sight, Sentinel, QRadar
• EDR/XDR:
  Crowd Strike, Microsoft Defender, Sentinel One
• Network Security:
  Palo Alto, Cisco, Check Point, Fire Power
• Data Protection:
  Symantec DLP, Triton, Guardium
• Threat Intelligence & SOAR Platforms
• Cloud Security Monitoring: AWS, Azure, or GCP environments

• Work Schedule:
  
  Monday - Friday

Some job boards have started using jobseeker‑reported data to estimate salary ranges for roles. If you apply and qualify for this role, a recruiter will discuss accurate pay guidance.

Citizens, its parent, subsidiaries, and related companies (Citizens) provide equal employment and advancement opportunities to all colleagues and applicants for employment without regard to age, ancestry, color, citizenship, physical or mental disability, perceived disability or history or record of a disability, ethnicity, gender, gender identity or expression, genetic information, genetic characteristic, marital or domestic partner status, victim of domestic violence, family status/parenthood, medical condition, military or veteran status, national origin, pregnancy/childbirth/lactation, colleague’s or a dependent’s reproductive health decision making, race, religion, sex, sexual orientation, or any other category protected by federal, state and/or local laws.

At Citizens, we are committed to fostering an inclusive culture that enables all colleagues to bring their best selves to work every day and everyone is expected to be treated with respect and professionalism. Employment decisions are based solely on merit, qualifications, performance and capability.