Sr IT Security Operations Analyst

Blackstone Talent Group, an award-winning technology consulting and talent agency is seeking a IT Security Operations Analyst - remote to join our team at our client’s site in Oakland, CA.

Position Summary Senior-level security operations resource supporting multiple complex, systemwide business services.

• Lead deep-dive threat analysis across IP, telephony, email, web, and software-package threat intelligence sources (Google Threat Intelligence, Twilio, Virus Total, and others), turning intelligence into actionable detections and response.
• Serve as tier-2/tier-3 escalation for security incident detection, response, containment, resolution, and recovery — including forensic analysis, security event analysis, data collection, packet analysis, and ticket management.
• Validate, tune, and mature detection content in Crowd Strike NG-SIEM (currently being implemented); confirm coverage, reduce false positives, and close visibility gaps.
• Perform large-scale log analysis and correlation using S3, Athena, and related tooling across AWS (WAF, RDS, security groups), F5, network logs, People Soft HCM, Pathlock (SSO, A360, SoD), Entrust, and other enterprise systems.
• Administer and maintain one or more security services (SIEM, vulnerability management, threat detection, phishing, DLP), including patching, configuration changes, troubleshooting, and customer requests.
• Prioritize and drive resolution of security issues with material financial or regulatory impact, including SOX-relevant systems and controls.
• Analyze, report, and remediate findings from vulnerability scans and penetration tests; track risk acceptance and remediation to closure.
• Create and maintain thorough technical security documentation for IT systems, architecture, and environments.
• Mentor junior analysts, contribute to runbook and playbook development, and advise IT and business stakeholders on risk.

• 8+ years on an IT security operations / incident response team in a senior analyst, engineer, or systems administrator capacity, including demonstrated ownership of complex investigations without supervision.
• Deep forensic and incident response analysis of complex business systems.
• Hands-on experience with modern SIEM platforms — implementation, tuning, detection engineering, and content development. Crowd Strike NG-SIEM or equivalent next-gen platform strongly preferred.
• Substantial AWS security experience: WAF, security groups, RDS, Cloud Trail/log pipelines, S3 and Athena for large-scale log analysis.
• Applied threat intelligence experience across multiple source types (IP, email, telephony, domain/file reputation) and the ability to operationalize it.
• Knowledge of security best practices across Linux, Windows, macOS, VMware, and Cisco IOS — including OS security tooling, configuration, logging, and patching.
• Working knowledge of public-key cryptography and best practices for protecting data at rest and in transit.
• Strong scripting ability (Python, Power Shell, Bash, or equivalent) for automation and data analysis.
• Strong verbal and written communication, including the ability to convey security risk to both technical administrators and non-technical executive stakeholders.
• Excellent analytical, design, and organizational skills; demonstrated ability to manage multiple concurrent assignments in a fast-paced environment.

• Background or formal education in data science; demonstrated use of statistical or data-driven methods in threat hunting and anomaly detection.
• Experience using AI/LLM tooling as an engineering aid for log analysis, correlation, and investigation acceleration.
• Experience supporting ERP/HCM environments (People Soft HCM) and access governance tooling (Pathlock, SoD, SSO).
• Worki…