Location Designation: Hybrid - 3 days per quarter

Role Overview

We are seeking a highly motivated and experienced SOC Analyst with strong expertise in cloud security and incident response to join our Cyber Security Operations team. The ideal candidate will be responsible for monitoring, detecting, analyzing, investigating, and responding to security incidents across hybrid and cloud environments. This role requires hands-on experience with cloud platforms, security monitoring tools, threat detection, and incident handling to protect organizational assets from evolving cyber threats.

What You'll Do:
• Monitor security alerts and events using SIEM, EDR, XDR, and cloud-native security tools.
• Investigate, triage, and respond to security incidents across cloud and on-premises environments.
• Perform incident analysis, containment, eradication, recovery, and post-incident reviews.
• Analyze logs from cloud platforms including AWS, Microsoft Azure, and Google Cloud Platform (GCP).
• Utilize cloud security services such as Microsoft Defender for Cloud, AWS GuardDuty, AWS Security Hub, and Google Security Command Center.
• Conduct threat hunting activities to identify indicators of compromise (IOCs) and emerging threats.
• Develop and maintain incident response playbooks, standard operating procedures (SOPs), and runbooks.
• Investigate phishing, malware, ransomware, insider threats, and unauthorized access incidents.
• Perform digital forensics evidence collection following established procedures.
• Participate in security assessments, tabletop exercises, and incident response drills.
• Prepare detailed incident reports, root cause analyses, and executive summaries.
• Stay current with the latest cyber threats, attack techniques, and cloud security best practices.

What You'll Bring:
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent work experience).
• 3-4 years of experience in Security Operations, Incident Response, or Cyber Defense.
• Hands-on experience with at least one major cloud platform:

o Amazon Web Services (AWS)

o Google Cloud Platform (GCP)
• Experience working with SIEM solutions such as Splunk, Google Chronicle, or Elastic.
• Experience with EDR/XDR platforms such as CrowdStrike Falcon, SentinelOne, or Palo Alto Cortex XDR.
• Strong understanding of security monitoring, log analysis, and threat detection.
• Experience investigating cloud-based attacks, identity compromise, privilege escalation, and lateral movement.
• Knowledge of MITRE ATT&CK framework and Cyber Kill Chain.
• Familiarity with identity and access management (IAM), Zero Trust principles, and multi-factor authentication.
• Experience with scripting or automation using PowerShell, Python, or Bash is preferred.
• Knowledge of networking concepts, TCP/IP, DNS, HTTP/S, VPNs, firewalls, IDS/IPS, and proxy technologies.

Preferred Certifications
• GIAC Certified Incident Handler (GCIH)
• AWS Certified Security - Specialty
• CompTIA Security+
• CompTIA CySA+

Technical Skills
• Cloud Security (AWS, Azure, GCP)
• Incident Response
• SIEM Engineering and Monitoring
• Threat Hunting
• Malware Analysis
• Cloud Identity Security
• Endpoint Detection and Response (EDR/XDR)
• Network Security
• Security Automation (SOAR)
• Log Analysis
• Threat Intelligence
• Scripting (Python, PowerShell, Bash)

Soft Skills
• Strong analytical and problem-solving abilities
• Excellent written and verbal communication skills
• Ability to perform effectively in high-pressure situations
• Strong attention to detail
• Team-oriented with excellent collaboration skills
• Ability to prioritize multiple incidents simultaneously
• Commitment to continuous learning and professional development

Preferred Experience
• Experience supporting 24x7 Security Operations Centers.
• Experience with SOAR platforms and automation workflows.
• Experience with container security (Kubernetes, Docker) and cloud-native application security.
• Familiarity with Infrastructure as Code (Terraform, CloudFormation) and DevSecOps practices.

Success Metrics
• Timely detection and response to security incidents.
• Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
• Accurate incident documentation and reporting.
• Continuous improvement of cloud security posture.
• Effective collaboration with cross-functional teams to minimize cyber risk.

Job Level: LEVELPF3

Pay Transparency

Salary Range: $100,000-$143,000

Overtime eligible: Exempt

Discretionary bonus eligible: Yes

Sales bonus eligible: No

Actual base salary will be determined based on several factors but not limited to individual's experience, skills, qualifications, and job location. Additionally, employees are eligible for an annual discretionary bonus. In addition to base salary, employees may also be eligible to participate in an incentive program.

Our Benefits

We provide a full package of benefits for employees - and have unique offerings for a modern workforce, including leave programs, adoption assistance, and student loan repayment programs. Based on feedback from our employees, we continue to refine and add benefits to our offering, so that you can flourish both inside and outside of work.Click hereto discover more about our comprehensive benefit options or visit our NYL Benefits Site.

Job Requisition ID: 94887