Description:

Position Summary:

A senior member of the Cyber Defense team who leads detection and response work and provides day-to-day leadership of the SOC. This individual serves as a technical leader - setting the cultural tone, modeling high standards, and managing the SOC queue to keep work prioritized and moving. They collaborate closely across exposure management, security engineering, and cloud security.
This role owns escalated investigations, takes point on escalated incidents, and proactively hunts threats across the enterprise. Success is measured by timely, high-quality investigations, effective incident response, a well-prioritized SOC, and clear documentation that enables consistent operations and continuous improvement.

Key Responsibilities:

• Lead alert triage and investigation: Serve as the escalation point for alerts raised by the managed SOC and monitoring systems. Pull together the full picture from whatever the investigation calls for: SIEM, EDR, identity and authentication activity, cloud audit trails, network and email telemetry, and other sources as the evidence leads. Reach accurate, defensible determinations under time pressure and decide what warrants escalation to a full incident.
• Run incident response: Take point on confirmed higher-severity incidents: scoping, containment, coordinating with affected stakeholders, and keeping leadership informed with clear, timely updates. Document incidents thoroughly and drive them to genuine closure, not just ticket closure.
• Hunt for what monitoring misses: Perform proactive threat hunting informed by current threat intelligence, surfacing coverage gaps and emerging risk before they become incidents.
• Work AI and automation into the daily craft: Use AI-assisted tooling to accelerate investigation, summarization, and documentation, and identify where AI and automation can reduce repetitive manual work, speed response, or close gaps-partnering with engineering to make it real.
• Partner across the team: Collaborate with exposure management on triage, prioritization, and remediation tracking, and work with security engineering and cloud security where investigations and detections cross over.
• Sharpen detections and tooling: Execute established runbooks, identify stale or missing guidance, and feed concrete improvement requests back to engineering to strengthen detections, automations, and documentation.
• Develop the SOC: Review SOC determination and escalation quality and provide coaching and feedback that helps analysts grow.
• Participate in the team's on-call rotation.
• Perform other duties as assigned.

Required Qualifications:

• 5+ years in security operations, incident response, or threat detection, with senior-level depth in digital forensics and incident response (DFIR) and SOC work.
• Hands-on investigation experience with a SIEM and an EDR platform-the specific products matter less than the ability to search, pivot across identity, cloud, and network log sources, and scope an incident end to end.
• Sound evidence-handling practice and forensic fundamentals, including preserving and reasoning over disk, memory, and log artifacts.
• A working understanding of adversarial behavior (e.g., MITRE ATT&CK).
• Working familiarity with exposure management workflows-triage, prioritization, and remediation tracking.
• Clear written and verbal communication, with the judgment to brief both engineers and executives appropriately.
• A collaborative working style and genuine curiosity about security and technology-a seasoned professional who exercises sound judgment and collaborates effectively across a larger organization.
• Internal candidates: SOC, security operations, or security engineering experience handling escalated investigations or incident response and working across detection, vulnerability management, or cloud security functions, with at least 1 year of SPS experience.
• Key Skills: Digital forensics and incident response (DFIR), SIEM/EDR investigation, threat hunting, adversarial behavior analysis (MITRE ATT&CK), cloud security monitoring, cross-team communication and executive briefing.

Preferred Qualifications:

• Experience with Crowdstrike as an EDR platform.
• Experience with SOAR platforms.
• Experience with Crowdstrike NG-SIEM.
• Cloud security monitoring experience, primarily AWS, with some exposure to Azure and GCP, and container environments such as EKS.
• Windows Defender XDR.
• Python programming experience for scripting, automation, or tooling.
• Familiarity with infrastructure-as-code (e.g., Terraform, CloudFormation) and CI/CD pipelines, and how to investigate and secure them.
• Familiarity with one or more of Oracle, Snowflake, Databricks, and the Atlassian suite.
• Proactive threat hunting and threat-intelligence experience.

Location:

This role follows a hybrid work model for candidates based in Minneapolis, MN and is also open to 100% remote candidates.

What We Offer:

At SPS Commerce, we are committed to ensuring that each employee's compensation reflects their unique experiences, performance, and skills in their role. The salary range for this role considers several factors, including education, relevant skills, work history, certifications, location, and more.

The annual salary range for this role is: $108,200.00 - $140,000.00 USD. The actual salary offered will be determined based on the factors listed above and may fall anywhere within the range.

SPS Commerce offers a comprehensive benefits package designed to support employees' health, well-being, and financial security. Benefits are country-specific and aligned with local laws and market practices.

#LI-TB1