Sr. Threat Detection Analyst

Ready to build what’s next with one of the world’s most iconic brands?

At Subway, we are not standing still. We are building.

This is a business focused on what matters most: growing franchisee profitability, strengthening our brand and creating long-term value. The people who thrive here are the ones who want to make a real impact.

You will not just do the work. You will shape it.

We move fast. We think like owners. We make decisions that

matter. We hold ourselves to a high standard because what we do directly impacts thousands of franchisees around the world.

If you bring energy, accountability and a bias for action,

you will fit right in.

We take the work seriously, but we also know the best

results come from teams that support each other, celebrate wins and show up ready to build something better every day.

This is your chance to be part of what’s next.

The Sr. Threat Detection Analyst is a senior, escalation-level analyst on the SOC team, combining hands-on investigation with threat intelligence to validate and contextualize alerts escalated by junior analysts. This is an individual contributor role with no direct reports, though mentorship and technical guidance to junior analysts are a core part of the job. The Sr. Threat Detection Analyst determines the scope and impact of escalated alerts, drives incidents toward resolution or a clean handoff for the most complex cases, and works to raise the skill level of the broader analyst team through coaching.

• Serve as a senior escalation point for alerts triaged by junior analysts, correlating signals across multiple security tools to validate true positives, rule out false positives, and determine the scope and business impact of an incident.
• Build attack timelines and identify indicators of compromise using Crowd Strike Falcon Next-Gen SIEM, applying threat intelligence, including IOCs, threat actor tactics and techniques, and OSINT research, to enrich investigations and inform escalation decisions.
• Investigate and respond to threats across the Microsoft 365 environment, including Microsoft Defender (Office 365, Endpoint, Cloud Apps), Exchange Online, and Purview compliance and DLP alerts; triage and act on cloud security findings from Wiz, including active threats, misconfigurations, vulnerabilities, and exposure risks.
• Execute and continuously refine incident response playbooks across categories including account takeover and credential stuffing, phishing and email based threats, insider threat and data exfiltration, endpoint and EDR detections and false positive disposition, network, firewall, and command and control activity, identity and SSO anomalies, DDoS, botnet, and web attacks, security coverage and hygiene gaps, and ransomware.
• Escalate confirmed, high severity, or technically complex incidents with clear, complete handoff documentation.
• Understand the logic behind detection rules and alerts well enough to identify tuning opportunities, feeding recommendations into the broader detection tuning workflow to reduce noise and improve detection fidelity.
• Contribute to playbook improvement based on patterns and trends observed during investigations.
• Mentor and coach junior analysts on triage methodology, investigation technique, and tool usage, building team capability without formal performance management responsibility.
• Communicate directly with employees and business stakeholders during investigations, explaining findings and next steps clearly and calmly, even in stressful or sensitive situations.
• Document investigation steps, findings, and remediation actions thoroughly in the case management system, in line with SOC incident response procedures, and support audit…