Required Skills & Experience
- 10+ years of cybersecurity experience, including at least 7 years of hands-on SOC, incident response, or threat detection and response experience in enterprise environments.
- Proven experience managing complex incidents end to end, such as business email compromise, credential compromise, ransomware precursors, cloud account compromise, or data exfiltration.
- Deep hands-on investigation experience with CrowdStrike Falcon and/or Microsoft Defender XDR. Advanced KQL experience and hands-on experience with CrowdStrike Next-Gen SIEM or a comparable SIEM.
- Working knowledge of Azure and AWS security logs and cloud incident response.
- Strong understanding of Entra ID/Active Directory, Microsoft 365, Windows, Linux, and common attacker techniques.
- Experience automating analyst tasks using Python, PowerShell, SOAR, or similar tools.
- Hands-on experience using AI-assisted security tools or generative AI during investigations, including independently validating AI-generated output.
- Strong written communication skills, including the ability to summarize incidents for nontechnical leadership.
Nice to Have Skills & Experience
- Experience with agentic SOC capabilities or autonomous triage agents in production.
- Experience with CrowdStrike, Wiz, Microsoft Defender for Cloud, AWS GuardDuty, or Defender for Cloud Apps. Digital forensics experience involving memory, disk, or cloud-log analysis.
- Malware analysis or reverse-engineering fundamentals.
Prompt-engineering experience for security investigations.
- Experience in regulated industries such as pharmaceutical, life sciences, healthcare, or financial services.
- Certifications such as GCIH, GCFA, GCIA, Microsoft SC-200, CrowdStrike CCFR, or CrowdStrike CCFH. Proven hands-on ability is valued more than certifications.
Job Description
We are seeking a hands-on Senior Threat Detection & Response Analyst to manage complex security incidents from initial alert through containment, recovery, and closure across endpoint, identity, email, network, cloud, and SaaS environments.
This person will work within an AI-augmented SOC, using AI-assisted tools to accelerate investigations while independently validating their output. They will also automate repetitive analyst tasks, improve detections and runbooks, and mentor junior analysts.
Key Responsibilities
- Own complex security incidents end to end, including triage, investigation, containment, eradication, recovery, documentation, and closure.
- Investigate threats across endpoint, identity, email, network, Azure, AWS, and SaaS environments to determine root cause, attack path, scope, and business impact.
- Triage high-severity alerts from CrowdStrike Falcon, Microsoft Defender XDR, CrowdStrike Next-Gen SIEM, Wiz, Defender for Cloud, and related security platforms.
- Coordinate containment actions such as host isolation, account disablement, token revocation, credential resets, IOC blocking, and email purges.
- Conduct threat hunting using KQL, CrowdStrike Query Language, and EDR tools, applying MITRE ATT&CK to analyze attacker activity and recommend detection improvements.
- Use tools such as Microsoft Security Copilot and CrowdStrike Charlotte AI to accelerate enrichment, analysis, query generation, timeline creation, and reporting while validating all AI-generated findings.
- Automate repetitive investigation and response tasks using Python, PowerShell, SOAR playbooks, Logic Apps, KQL, or AI-agent workflows.
- Lead post-incident reviews, maintain response runbooks, mentor junior analysts, and serve as an escalation point for MDR/MSSP partners.
- Participate in the on-call rotation for critical security incidents.