Job description

The Cybersecurity Operations Senior Analyst is responsible for security monitoring, investigations, incident response, threat analysis, detection engineering, and technical leadership within the Security Operations Center. This position serves as a senior technical resource and is expected to exercise sound technical judgment while working collaboratively with other analysts and cross-functional teams to investigate complex security events, correlate disparate enterprise data sources, identify anomalous or malicious behavior, and develop technically defensible findings and recommendations. The Senior Analyst is expected to take ownership of assigned work, collaborate effectively with peers and subject-matter experts, contribute to team objectives, and provide technical guidance and mentorship to other analysts. Job Duties and Responsibilities: Monitor for Security Events & Advanced Threat Analysis - 40% Lead advanced monitoring and analysis of enterprise security events and telemetry. Provide timely detection, identification, investigation, and escalation of potential attacks, intrusions, anomalous activity, and misuse. Lead proactive threat hunting based on emerging threats, adversary behaviors, organizational risk, and observed trends. Correlate data across SIEM, EDR, identity, network, cloud, email, and other enterprise data sources to identify anomalous or malicious behavior. Develop, validate, tune, and maintain detection rules, investigative queries, notifications, and reporting capabilities. Evaluate detection effectiveness and recommend improvements based on investigative findings and observed behavior. Identify telemetry, logging, and detection gaps and develop appropriate recommendations or alternative investigative approaches. Respond to Incidents & Lead Complex Investigations - 35% Lead complex cybersecurity investigations from initial detection through containment, remediation, recovery, and closure. Serve as a senior incident lead and technical resource during cybersecurity incidents. Coordinate incident-response activities across Security and partner teams. Determine appropriate investigative approaches, data sources, technical pivots, and evidence necessary to support investigative findings. Collaborate with analysts, infrastructure teams, application owners, and other subject-matter experts when their expertise is necessary to investigate or resolve an incident. Provide technical support during an incident as required. Write and distribute detailed incident reports and after-action reviews. Identify lessons learned and recommend improvements to security controls, detections, telemetry, procedures, and response capabilities. Produce executive-level incident summaries and communicate complex technical findings to technical and nontechnical audiences. Security Research & Technical Leadership - 25% Conduct enterprise-wide research into emerging threats, vulnerabilities, adversary techniques, technologies, and defensive practices. Serve as a technical resource and escalation point for other SOC analysts. Provide technical guidance and mentorship while promoting collaboration and shared accountability across the team. Develop and maintain SOC playbooks, runbooks, procedures, investigative methodologies, and technical documentation. Identify opportunities to improve SOC detection coverage, investigative capabilities, operational efficiency, and response maturity. Lead or contribute to cross-functional cybersecurity initiatives requiring technical analysis. Provide daily, periodic, trend, and executive-level reporting regarding security activity and/or emerging risk. Share investigative techniques, technical knowledge, and lessons learned to improve overall team capability. Qualifications (Education, Experience, Certifications & KSA): Bachelor s degree in cybersecurity, information technology, computer science, or a related discipline preferred; an equivalent combination of education and relevant professional experience may be considered. 5-7 years of relevant cybersecurity experience, including experience in security operations, security investigations, incident response, or related cybersecurity functions. Demonstrated ability to analyze complex or ambiguous technical problems, determine appropriate next steps, and work collaboratively with relevant resources toward resolution. Demonstrated ability to correlate information from multiple security technologies and data sources to develop defensible conclusions and recommendations. Working knowledge of SIEM, EDR, identity, network, endpoint, and other cybersecurity technologies. Knowledge of security monitoring, incident response, threat hunting, detection engineering, and investigative methodologies. Demonstrated ability to work effectively as part of a team, provide technical guidance, accept and incorporate feedback, and contribute to the development of other analysts. Demonstrated ability to operate effectively in high-accountability environments where individual ownership, team success, operational discipline, and timely execution are essential. Advanced cybersecurity certifications in areas such as incident response/DFIR, security architecture, cloud security, offensive security, detection engineering, or related disciplines are preferred but not required. Strong written and verbal communication skills with the ability to communicate technical information to both technical and nontechnical audiences. The above statements are intended to describe the general nature and level of work being performed by people assigned to this job. They are not intended to be an exhaustive list of all responsibilities, skills, efforts or working conditions associated with a job. We offer our employees a robust compensation package! Our comprehensive benefits include: medical, dental and vision insurance coverage; 100% company-paid life and disability coverage, 401k options with company match, three weeks PTO by the end of the first year and much more. Allied proudly promotes from within as part of a strong commitment to providing career growth opportunities for employees of all levels. Our diverse business portfolio allows employees broad career options with the advantage of staying with the same organization. All qualified candidates will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status, or any other characteristic protected by law. To view our privacy statement click here To view our terms and conditions click here

Requirements

Must-haves

Monitor for Security Events & Advanced Threat Analysis - 40%
Lead advanced monitoring and analysis of enterprise security events and telemetry.
Provide timely detection, identification, investigation, and escalation of potential attacks, intrusions, anomalous activity, and misuse.
Lead proactive threat hunting based on emerging threats, adversary behaviors, organizational risk, and observed trends.
Correlate data across SIEM, EDR, identity, network, cloud, email, and other enterprise data sources to identify anomalous or malicious behavior.
Develop, validate, tune, and maintain detection rules, investigative queries, notifications, and reporting capabilities.
Evaluate detection effectiveness and recommend improvements based on investigative findings and observed behavior.
Identify telemetry, logging, and detection gaps and develop appropriate recommendations or alternative investigative approaches.
Respond to Incidents & Lead Complex Investigations - 35%
Lead complex cybersecurity investigations from initial detection through containment, remediation, recovery, and closure.
Serve as a senior incident lead and technical resource during cybersecurity incidents.
Coordinate incident-response activities across Security and partner teams.
Determine appropriate investigative approaches, data sources, technical pivots, and evidence necessary to support investigative findings.
Collaborate with analysts, infrastructure teams, application owners, and other subject-matter experts when their expertise is necessary to investigate or resolve an incident.
Provide technical support during an incident as required.
Write and distribute detailed incident reports and after-action reviews.
Identify lessons learned and recommend improvements to security controls, detections, telemetry, procedures, and response capabilities.
Produce executive-level incident summaries and communicate complex technical findings to technical and nontechnical audiences.
Security Research & Technical Leadership - 25%
Conduct enterprise-wide research into emerging threats, vulnerabilities, adversary techniques, technologies, and defensive practices.
Serve as a technical resource and escalation point for other SOC analysts.
Provide technical guidance and mentorship while promoting collaboration and shared accountability across the team.

Nice-to-haves

Bachelor s degree in cybersecurity, information technology, computer science, or a related discipline preferred; an equivalent combination of education and relevant professional experience may be considered.
Advanced cybersecurity certifications in areas such as incident response/DFIR, security architecture, cloud security, offensive security, detection engineering, or related disciplines are preferred but not required.

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: workday
Effort: long

Benefits

Benefits detected in the listing.

Dental

Vision

401k

Pto