Lead Security Operations Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee operational triage, analysis, and prioritization of intricate security incidents across multiple client environments.

• Act as Incident Commander during significant security occurrences.

• Implement containment, eradication, and recovery strategies in line with NIST SP 800-61r2.

• Spearhead proactive threat hunting and detection engineering utilizing MITRE ATT&CK.

• Develop custom correlation rules including Sigma and YARA.

• Ensure that incident notifications and responses adhere to contractual SLAs and regulatory reporting deadlines.

• Enhance the MSSP application backend with production-quality code in Python, Node.js, or Go.

• Create integrations for EDR, DNS security, threat intelligence, spam/phishing, identity management, firewall, and IDS telemetry.

• Design SOAR playbooks for dynamic triage, identity enrichment, and automated tenant isolation.

• Implement LLM-based alert summarization and enrichment using Gemini, BigQuery, REST webhooks, RAG pipelines, and MCP servers.

• Improve detection pipelines with machine learning and AI filters to minimize false positives.

• Align monitoring controls with NIST CSF 2.0, ISO/IEC 27001:2022, and NIST SP 800-53r5.

• Ensure compliance of incident response and telemetry collection with GDPR, Brazil LGPD, and US state privacy laws.

⛳️ Requirements

• Proficiency in at least one platform or tool in each of the required categories: SIEM/XDR, network/telemetry, AI/automation, SOAR/scripting, threat frameworks, and cloud environments.

• SIEM/XDR experience with tools such as Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, or Palo Alto Cortex XDR.

• Experience in network and telemetry using Wireshark, Zeek, Suricata, PCAP analysis, Syslog, Windows Event Logs, or CloudTrail/CloudWatch.

• Familiarity with AI and automation tools including Python (Pandas, Requests), REST APIs, Cursor IDE, GitHub Copilot, Claude/OpenAI APIs, LangChain, Webhooks, or Docker.

• Background in SOAR and scripting with Python, PowerShell, Bash, Demisto/Cortex XSOAR, Shuffle, or Tines.

• Knowledge of MITRE ATT&CK, NIST SP 800-61r2, Cyber Kill Chain, YARA, and Sigma Rules.

• Experience with security architectures, IAM, and log architectures in AWS, Azure, or GCP.

• A minimum of 3 years' experience in a SOC or MSSP environment is preferred.

• At least 2 years in a Level 3 / Lead SOC role is preferred.

• Hands-on experience with scripting and API integration for automating incident response playbooks.

• Proficiency in AI-assisted coding tools like Cursor or Copilot.

• Expertise in log analysis across endpoint, identity, network, and multi-cloud environments.

• At least one required certification: GCIH, GMON, GNFA, CySA+, CASP+, or OSCP.

• CISSP certification is preferred.

🏝️ Benefits

• Equal employment opportunity and anti-discrimination protections.

• The interview process includes a work style survey, hiring coordinator screen, manager interview, peer interview, and senior leadership interview.

• Decisions are typically made within one week following the interviews.