Summary:
The Opportunity
Hyatt Hotels Corporation seeks an enthusiastic Lead Analyst - Cyber Security Operations to join our Cyber Security Department. In this role, you will be collaborating closely with the broader Digital & IT team, where you'll be instrumental in continuing to make Hyatt a leading hospitality company. You will be part of a team that is passionate about our purpose, committed to nurturing curiosity and new skills, and building connections across the organization with colleagues, customers, and guests.
The Role
At Hyatt Hotels, Cyber Security is an essential component of our mission to take care of people so they can be their best. The Lead Analyst - Cyber Security Operations plays a crucial role in completing that mission every day by ensuring the global security of our guests, colleagues, and hotels.
As the most senior individual contributor on the Cyber Security Operations team, the Lead Analyst will be responsible for providing technical expertise and coordinating incidents Response engagements.
Your day-to-day responsibilities will include triaging and investigating security alerts, proactive threat hunting, responding to incidents, building detections, and documenting procedures and playbooks.
You will drive measurable improvements in Cyber Security Operations outcomes, including faster detection and containment of high-severity threats, reduced incident impact and recurrence, and more effective coverage of priority attack scenarios; use validated results to guide operational priorities and report progress.
This highly technical role will have a high degree of visibility throughout the organization and will have a deeply meaningful impact on the safety and security of guest and colleague data.
Responsibilities
• Respond swiftly to Cyber Security incidents as they are detected, ensuring that attackers are are removed from the environment, and Hyatt's operations are restored with minimal disruption
• Lead incident response engagements for Cyber Security and Data Privacy incidents speaheading the triage, containment, eradication, recovery, evidence preservation, post-incident reviews, and corrective actions
• Act as subject matter expert in analyzing detections on endpoints, cloud, SaaS & AI
• Perform forensic analysis, timeline reconstruction, identifying telemetry gaps, and detection engineering
• Perform AI/Agentic SOC responsibilities, such as:
o AI-assisted investigations, enrichment, hunting, and documentation
o Working with supervised security agents and semi-autonomous workflows
o Validating AI outputs and identifying hallucinations or missing context
o Measuring AI effectiveness through accuracy, traceability, escalation quality, action success, and time savings
• Identifying gaps in Hyatt detection pipeline and work on building new detections
• Perform proactive threat hunting searches looking for signs of intrusion in both the Hyatt and Hyatt Franchise environments
• Act as senior-most technical resource for the SOC, develop intimate knowledge of the computing environment and use that knowledge to differentiate legitimate from illegitimate behaviors
• Prepare and present updates for senior leadership on cyber defense program performance
• Review past incident response performance with Security Operations team to identify potential program improvements
• Act as the Point of escalation for operations/security issues
• Must be willing to work off-shift hours, as needed, during incidents. Must also be available for on-call rotation
• Demonstrate a commitment to Hyatt core values
A successful candidate would possess these skills:
• Proven ability to lead and coordinate a team of analysts
• Strong communication skills, including delivering findings and updates to technical and non-technical teams
• Ability to make sound, timely decisions during high-severity or ambiguous incidents
• Ability to manage competing priorities across ticket queues, escalations, and personnel needs
• Strong coaching and mentoring skills to develop L1 and L2 Analysts
• Ability to build and sustain professional relationships across internal and external stakeholder groups
• Meticulous attention to quality, demonstrated through high-quality documentation
• Ability to lead process-improvement initiatives and own runbook/playbook governance
• Ability to remain composed and provide clear direction during critical incidents
• Ability and willingness to operate in a fast-paced, complex corporate environment
• Ability to be on call for cyber incidents impacting the organization
• Ability to travel approximately 5% of work time
Qualifications:
Experience Required:
• Minimum of five years' experience in the Cyber Security Operations, or Incident Response
• Extensive knowledge of Advanced Persistent Threats (APT) tactics, technics and procedures
• Deep knowledge of the TCP/IP and OSI network stack and its protocols
• Technical skills associated with Crowdstrike CQL, SPL, KQL, SQL, Python, PowerShell & SOAR
• Familiarity with cutting-edge security technologies such as Zero-Trust Network Access, FIDO 2.0, Endpoint & Extended Detection and Response (EDR/XDR), Web Security Gateways (WSG), Email Security Gateways (ESG), Web Application Firewall (WAF), sandboxes, network- and host- based firewalls, Threat Intelligence, Penetration Testing, etc
• Experience working in a high-intensity threat actor environment
• Experience preparing and presenting status updates for executive leadership
• Experience reviewing and updating Cyber Security Incident Response documentation and time reconstruction
• Knowledge of SaaS, Cloud, information systems terminology, controls, and practices
• Strong verbal and written communication and presentation skills
• Ability to effectively interact with different areas and level of the organization, including executive leadership
• Proactive self-starter with ability to work independently and as part of a larger team
• Familiarity with threat hunting and adversary tactics and techniques (i.e., MITRE ATT&CK, Cyber Kill Chain)
• Familiarity with threat response frameworks (i.e., SANS PICERL, NIST SP 800-61)
• Familiarity with cyber and privacy regulatory requirements (i.e., SEC cybersecurity disclosure rules, CCPA/CPRA, GDPR)
• GIAC - Global Certified Incident Handler (GCIH), or any of the equivalent GIAC, ISC2, ISACA, CompTIA or EC-Council certification
Experience Preferred:
• A bachelor's degree or better in Cyber Security, Information Systems, or any other security-related subject is preferred; however, any combination of education, experience, and certification that demonstrates the candidate can be successful in the position is acceptable.
The position responsibilities outlined above are in no way to be construed as all-encompassing. Other duties, responsibilities, and qualifications may be required and/or assigned as necessary.
We welcome you:
Research shows that individuals tend to apply to jobs only if they meet all the listed job qualifications. Unsure if you check every box, but feeling inspired to enhance your career? Apply. We'd love to consider your unique experiences and how you could make Hyatt even better.
The salary range for this position is $120,000 - $160,000
The final pay rate/salary offered to the successful candidate will depend on experience, skill level and other qualifications for the role, as well as the location of the performance of work. Pay for the successful candidate will meet local requirements, including the local minimum wage rate.
We value our relationships with recruitment partners and require that agencies contact us first before submitting any candidates. Hyatt will not be responsible for any fees and obligations associated with unsolicited submissions unless a formal agreement is in place.
