Senior Security Analyst, Cyber Defense

Position Summary

SPS Commerce is a leading provider of cloud‑based supply chain management solutions. As a senior member of the Cyber Defense team, you will lead detection and response activities, manage the SOC day‑to‑day, and drive continuous improvement across threat investigation, incident response, and threat hunting.

• Lead alert triage and investigation, serving as the escalation point for SOC alerts and gathering evidence from SIEM, EDR, identity, cloud audit trails, network and email telemetry, and other sources.
• Run incident response for confirmed high‑severity incidents: scope, contain, coordinate with stakeholders, and provide timely updates to leadership.
• Document incidents thoroughly and ensure genuine closure beyond ticket completion.
• Conduct proactive threat hunting informed by threat intelligence, surfacing gaps before they become incidents.
• Integrate AI and automation tools to accelerate investigation, summarization, and documentation, and collaborate with engineering to implement improvements.
• Collaborate with exposure management, security engineering, and cloud security teams on triage, prioritization, and remediation tracking.
• Sharpen detections and tooling by executing runbooks, identifying stale or missing guidance, and providing improvement requests to engineering.
• Develop the SOC by reviewing determination quality, coaching analysts, and participating in on‑call rotation.
• Perform additional duties as assigned.

• 5+ years in security operations, incident response, or threat detection with senior‑level depth in DFIR and SOC work.
• Hands‑on investigation experience with SIEM and EDR platforms, capable of searching, pivoting across identity, cloud, and network logs, and scoping incidents end to end.
• Sound evidence‑handling practice and forensic fundamentals for preserving and reasoning over disk, memory, and log artifacts.
• Understanding of adversarial behavior (e.g., MITRE ATT&CK).
• Familiarity with exposure management workflows—triage, prioritization, and remediation tracking.
• Clear written and verbal communication with the judgment to brief engineers and executives appropriately.
• Collaborative style, genuine curiosity about security and technology, and sound judgment across a large organization.
• Internal candidates must have SOC, security operations, or security engineering experience handling escalated investigations or incident response, along with at least 1 year of SPS experience.

• Experience with Crowd Strike as an EDR platform.
• Experience with SOAR platforms and Crowd Strike NG‑SIEM.
• Cloud security monitoring experience, primarily AWS, with exposure to Azure, GCP, and container environments such as EKS.
• Knowledge of Windows Defender XDR.
• Python programming for scripting, automation, or tooling.
• Familiarity with IaC (Terraform, Cloud Formation) and CI/CD pipelines, and how to investigate and secure them.
• Exposure to Oracle, Snowflake, Databricks, and the Atlassian suite.
• Proactive threat hunting and threat‑intelligence experience.

This role follows a hybrid work model for candidates based in Minneapolis, MN and is also open to 100% remote candidates.

The annual salary range is $ – $ USD. The actual salary offered will be determined based on factors such as education, skills, experience, certifications, location, and more. SPS Commerce offers a comprehensive benefits package designed to support employees’ health, well‑being, and financial security. Benefits are country‑specific and aligned with local laws and market practices.

We are committed to affirmative action and equal opportunity in all aspects of employment. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.