Cybersecurity Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Monitor and triage security alerts across identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies

• Validate, enrich, classify, prioritize, and investigate security events and incidents

• Execute approved containment actions and coordinate infrastructure-level or production changes with Technology Operations

• Collect and preserve evidence and assist in eradication, recovery validation, heightened monitoring, and incident closure

• Gather and evaluate threat intelligence from commercial, government, industry, open-source, MDR, vendor, and internal sources

• Analyze threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies

• Develop intelligence products and operationalize findings through investigations, detections, hunting queries, watchlists, blocking actions, phishing simulations, and runbook updates

• Conduct hypothesis-driven threat hunts using MITRE ATT&CK, documenting scope, queries, evidence, findings, and follow-up actions

• Validate vulnerability findings, assess risk and business exposure, prioritize remediation, identify exploitation, and escalate urgent vulnerabilities

• Coordinate remediation assignments, maintain vulnerability ticket flow, track service levels, report overdue exposure, and escalate ownership or delivery issues

• Maintain oversight of vulnerability validation, prioritization, ticketing, remediation follow-up, SLA reporting, and escalation

• Develop and maintain approved automation workflows, scripts, and playbooks

• Preserve digital evidence in accordance with approved forensic, legal-hold, integrity, and chain-of-custody procedures

• Maintain comprehensive case records and validate incident containment and corrective actions

• Support breach investigations for Legal and Privacy review

• Investigate token theft, MFA changes, privilege escalation, malicious application consent, mailbox manipulation, and compromised identities

• Investigate third-party, supply-chain, and AI-related security notifications or suspected misuse

• Execute alert triage, investigations, MDR monitoring, threat-intelligence analysis, threat hunting, vulnerability validation, remediation follow-up, metrics, reporting, case documentation, and authorized security-tool actions

• Escalate architecture, complex integration, detection-platform design, routine vulnerability-management administration, and permanent engineering needs to Security Engineering

• Provide structured handovers across operating regions

• Provide technical evidence to Legal and Privacy without independently determining legal privilege, regulatory interpretation, or notification obligations

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or a related field, or equivalent practical experience

• 3+ years of experience in cybersecurity operations, incident response, IT operations, system administration, network security, or a related area

• Experience in investigating alerts using SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability technologies

• Knowledge of common attacker techniques, phishing, malware, account compromise, privilege misuse, lateral movement, exfiltration, and vulnerability exploitation

• Proven experience in applying threat intelligence and incident telemetry to vulnerability prioritization and exploitation assessment

• Experience with security automation or scripting, digital-evidence handling, identity investigations, third-party incident analysis, and structured case management

• Familiarity with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments

• Understanding of MITRE ATT&CK and common detection, threat-hunting, and incident-response methodologies

• Comprehension of vulnerability scanning and remediation workflows and the division of responsibility between vulnerability-program governance, threat-led escalation, and asset-owner remediation

• Familiarity with NIST CSF, ISO 27001, PCI DSS, NYDFS cybersecurity requirements, or privacy and breach-response obligations

• Ability to support defined US business-hour coverage and participate in an escalation or on-call rotation

• Availability to assist with high-severity incidents outside normal working hours as needed

• Capability to handle confidential, legally sensitive, and security-restricted information appropriately

• Applicants must be authorized to work for any employer in the U.S.

• Relevant certifications such as Security+, CySA+, SC-200, GCIH, GCIA, or equivalent experience are preferred

🏝️ Benefits

• Monthly bonuses

• Restricted Stock Units for all new team members, vesting over 4 years

• Full medical, dental, and vision benefits at no cost to the employee

• Four weeks of paid time off

• 9 paid float holidays

• Five-week sabbatical after five years of employment

• Open, casual, pet-friendly, and fun office environment

• Free medical health insurance for one dog or cat

• Paid time off to volunteer at nonprofit organizations

• Free on-site gym

• Free dog walking services for office pets during business hours

• Free parking

• Paid ORCA cards