Develop, maintain, and continuously improve threat detection and response playbooks and standard operating procedures (SOPs), incorporating industry best practices, regulatory requirements, and lessons learned.
Participate in cross-functional initiatives to implement to deliver improvements to security operations—tools, processes, and procedures—driving efficiency and resiliency.
Use enterprise-authorized AI capabilities to accelerate triage, evidence synthesis, and incident reporting, validating outputs and handling data in line with sensitivity and security requirements.
Required qualifications, capabilities, and skills
Formal training or certification with 3+ years of experience working in information security, with a focus on security operations center (SOC) analysis and incident response.
Strong investigative mindset: Ability to demonstrate a structured, analytical approach to investigating alerts and/or indicators and documenting your findings in a manner that both peer and executive level colleagues can understand.
Hands-on familiarity with security tools and technologies, including SIEM, intrusion detection systems, email analysis, vulnerability analysis, log analysis, PCAP and malware analysis.
Foundational understanding of operating systems, cloud, and networking fundamentals: e.g., OSI model, Windows/Linux basics, and protocols such as TCP/IP, HTTP(S), DNS, DHCP, SMTP, and FTP.
Basic scripting/automation skills (or strong interest in developing them) to improve security workflows using tools/languages such as Python, PowerShell, or Bash.
Able to produce clear investigation notes, concise incident updates, and audience-appropriate summaries.
Knowledge of cyber threats and adversary TTPs: Familiarity with MITRE ATT&CK and common mitigations/detection approaches.
Willingness to work a shift pattern that may include weekend/holiday coverage (with appropriate scheduling/rotation).
Preferred qualifications, capabilities, and skills
Degree in Computer Science, Information Security, or a related field.
Industry-recognized security certifications (e.g., GIAC: GSEC/GCIH/GCFA; ISC2: CISSP/CCSP).
Comfortable working in a matrixed environment: Demonstrates collaboration skills and the ability to coordinate with partners to deliver outcomes.
Good communicator (written and verbal)
Demonstrated experience using enterprise-authorized AI capabilities to support security operations workflows, with strong validation habits and awareness of data sensitivity.
Some experience using enterprise-authorized AI capabilities to support security operations workflows, with strong validation habits and awareness of data sensitivity.
#ctc
