Senior Information Security Analyst

As a Senior Information Security Analyst, you won't just respond to incidents — you'll shape how we detect, investigate, and neutralize them. You'll mentor the next generation of analysts, drive measurable improvements in detection quality, and serve as the calm, decisive voice when the pressure is highest. You'll operate as a senior technical leader within the SOC — owning complex investigations, driving high-severity incidents to resolution, and elevating the capability of the entire team. Lead end-to-end investigation of complex, multi-vector security incidents across endpoint, identity, email, network, and cloud telemetry, including P1 and P2 events. Serve as the incident commander or primary investigator on high-severity incidents, coordinating cross-functional response efforts with ThreatOps, SecOps Engineering, IT, and application teams. Reconstruct detailed attack timelines and determine blast radius by correlating diverse telemetry sources, producing executive-ready incident summaries. Mentor and coach junior and mid-level SOC analysts, conducting case reviews, providing real-time guidance during active investigations, and raising the team's technical baseline. Design, refine, and validate detection logic across SIEM, EDR, and cloud security platforms — owning the detection quality lifecycle from hypothesis through tuning and retirement. Drive measurable reduction in false positive volume and mean time to detect/respond through continuous process and tooling improvements. Identify, scope, and champion automation opportunities, partnering with SecOps Engineering to build SOAR playbooks that eliminate repetitive manual work. Author and maintain advanced triage and investigation runbooks, ensuring consistency and scalability across shifts. Lead post-incident reviews and after-action reports, translating lessons learned into concrete detection, process, or architecture improvements. Proactively hunt for threats using hypothesis-driven methodologies, threat intelligence, and behavioral analytics. Represent SOC capabilities and findings to senior leadership and cross-functional stakeholders with clear, concise communication. Participate in and help design tabletop exercises, purple team engagements, and response drills to stress-test and strengthen readiness. Stay current on emerging threats, attacker tradecraft, and industry trends, feeding relevant intelligence back into detection and response strategies. 3+ years in an information security analyst or SOC analyst role with demonstrated progression in responsibility. 5+ years of experience in a technology role. Bachelor's degree in information assurance, computer science, or a related field, or equivalent experience. Deep hands-on experience with SIEM platforms, including advanced query building, correlation rule development, and large-scale log analysis. Strong proficiency with endpoint detection and response tooling, including the ability to conduct deep-dive forensic investigations. Expert-level understanding of operating systems (Windows, macOS, Linux/Unix) internals, network protocols, and traffic analysis. Ability to write scripts and automation (Python, PowerShell, or equivalent) to support investigations and operational efficiency. Strong command of the MITRE ATT&CK framework with the ability to map observed activity, identify coverage gaps, and inform detection strategy. Proven experience owning incidents through the full incident response lifecycle — detection, containment, eradication, recovery, and post-incident review. Demonstrated ability to lead under pressure, make sound decisions with incomplete information, and communicate clearly to both technical and non-technical audiences. Experience mentoring or providing technical guidance to other analysts. Schedule flexibility — available to work outside standard business hours, including evenings, weekends, and holidays, as incident severity and volume demand. Experience serving as incident commander or lead investigator on P1 incidents in an enterprise environment. Demonstrated track record of designing or significantly improving detection logic with measurable impact on alert fidelity. Hands-on experience building or operationalizing SOAR playbooks and security automation workflows. Industry certifications such as GCIH, GCFA, GCIA, CISSP, or CISM. Experience with cloud security monitoring and incident response across AWS, Azure, or GCP environments. Familiarity with threat hunting methodologies and proactive detection approaches. Experience in the mortgage, financial services, or another regulated industry. Prior experience contributing to or leading purple team exercises. About Us.