Sr. Security Operations Analyst

Role Overview
We are seeking a highly technical and proactive Sr. Security Operations Analyst to join our Information Security team. In this role you will engineer and mature our security operations infrastructure — designing automated playbooks, tuning advanced telemetry across SIEM, EDR, and cloud environments, and leading high-severity incident containment. As a senior member of the team, you will define triage standards and elevate the technical capability of the wider SOC.
Responsibilities
Detection engineering: Architect and optimize real-time detection engineering playbooks across SIEM, EDR, and cloud security platforms to minimize false positives, accelerate triage, and scale threat-hunting capability.
Investigation: Investigate suspicious activity, correlate findings across data sources, and document clear, timely case notes for each alert or incident.
Incident command: Lead the response lifecycle for high-severity incidents as primary investigator or incident commander, ensuring seamless coordination and technical handoff across cross-functional teams.
Containment: Execute containment actions under established playbooks, including endpoint isolation, disabling compromised accounts, and blocking malicious indicators.
Threat hunting: Research indicators of compromise and apply threat intelligence to identify anomalous behavior.
Rule tuning: Tune detection rules and use cases to reduce false positives and close visibility gaps, in coordination with engineering.
Email threats: Investigate and remediate email-based threats such as phishing and business email compromise, from both user submissions and automated detection.
Continuous improvement: Contribute to post-incident reviews and metrics reporting — MTTD, MTTR, alert volume, and false-positive rate — to support ongoing SOC maturity.
Currency: Stay current on emerging threats, attacker TTPs, and industry frameworks such as MITRE ATT&CK.
Requirements
SIEM platforms
Splunk
Microsoft Sentinel
QRadar
EDR platforms
CrowdStrike
Microsoft Defender for Endpoint
SentinelOne
Windows operating systems
Linux operating systems
TCP/IP
DNS
Firewalls
Network proxies
Incident response
Threat hunting
Detection engineering
Log analysis
MITRE ATT&CK framework
Phishing investigation
Business email compromise
Written communication
Case documentation
Preferred Skills
AWS
Azure
GCP
Cloud security
SOAR platforms
Python
PowerShell
KQL
SPL
Security automation
Playbook development
Qualifications
4–6 years of IT or security experience, including hands-on exposure to a SOC, security help desk, or systems administration environment
3+ years monitoring or investigating alerts using a SIEM (e.g., Splunk, Sentinel, QRadar) and an EDR platform (e.g., CrowdStrike, Defender for Endpoint, SentinelOne)
Working knowledge of Windows and Linux operating systems, including common attack surfaces and log sources such as event logs, auth logs, and process telemetry
Foundational understanding of networking concepts (TCP/IP, DNS, proxies, firewalls) and the protocols relevant to intrusion detection
Strong attention to detail, sound judgment under time pressure, and clear written communication for case documentation and shift handoffs
Ability to work effectively in a 24/7 SOC rotation, including scheduled shifts and periodic on-call coverage
Bachelor's degree in Cybersecurity, Information Technology, or a related field — or equivalent hands-on experience
Foundational certifications such as CompTIA Security+ or CySA+ are expected; progress toward GIAC (GCIH, GFACT) or similar is a plus
We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

Work arrangement
No