WHAT YOU'LL DO:

· Proactively monitor tools, feeds, and dashboards for security alerts.

· Identify and triage alerts from internal systems and respond to alerts from managed SOC providers.

· Follow established process while responding to incidents and preparing reports.

· Lead complex, multi-system security investigations from initial signal through containment recommendations, remediation, and written findings.

· Correlate telemetry across endpoint, identity provider, email, SaaS, cloud, network, and other data to determine what happened, what was affected, and what action is required.

· Use AI/LLM assistants for triage, enrichment, log summarization, timeline development, and detection drafting while validating outputs against source evidence and recognizing hallucinated or incomplete analysis.

· Identify opportunities to improve SOC processes, detections, and workflows, including recommending where AI, automation, or playbook enhancements could reduce manual effort, improve consistency, or accelerate response.

· Provide technical guidance and assistance to other team members, fostering knowledge sharing and skill development within the team.

· Provide input to and report on metrics for alerts, incidents, responses, and operations.

· Assess managed SOC escalations for quality, urgency, and completeness; provide feedback that improves escalation criteria and alert fidelity.

· Work closely with multiple groups and business units globally to provide guidance and support.

· Work closely with internal stakeholders and managed security partners to respond to alerts and incidents and escalate as necessary.

· Stay current with the evolving threat landscape, defensive capabilities, and relevant security tools and techniques, including AI-assisted analysis, automation, and emerging attacker tradecraft.

· Conduct threat hunts leveraging threat intelligence to proactively identify, investigate, and remediate emerging security threats across the organization.

· Participate in purple team exercises, combining offensive and defensive tactics to strengthen the organization's security posture, enhance threat detection and improve incident response capabilities.

· Analyze vulnerabilities and exposure signals in context of exploitability, asset criticality, compensating controls, and observed threat activity to help prioritize remediation.

· Collaborate closely with the Security Engineering team to enhance automations and workflows, develop new detection capabilities, and identify areas for improvement in security processes and tools.

WHAT YOU'LL BRING:

· Hands-on cybersecurity operations, incident response, threat hunting, vulnerability management, or closely related cybersecurity experience.

· Understanding of general enterprise network and system components and their roles (databases, webservers, app servers).

· Familiarity with network and application protocols (TCP/IP, HTTP, TLS, SSH, DNS, etc.).

· Experience working with servers or workstations running Windows, Linux, or OS X.

· Experience investigating, securing, or supporting cloud systems, platforms, and resources.

· Experience with security tools like EDR, SIEM, etc.

· Understanding of cybersecurity concepts and emerging threats.

· Experience in phishing and malware analysis.

· Strong documentation habits with excellent written and oral communication skills.

· Strong work ethic with attention to detail.

· Strong analytical and problem-solving skills.

· Ability to work independently on complex threat analysis and alert triage while maintaining accuracy and efficiency.

· Ability to excel in a fast paced and rapidly changing environment.

REQUIREMENTS:

· Strong working knowledge of cybersecurity operations, incident response, and the technologies commonly used to investigate and contain security events.

· 2+ years of experience working hands on in a cybersecurity focused role preferred.

· GIAC, (ISC)2, or other relevant security certifications a plus.

The pay range for this position is $90,000 - $120,000/yr USD.

#L1-TB1