Senior Security Analyst, MDR

This is a fully remote position, open to applicants in Australia.

📋 Description

• Become a founding analyst for Apollo, the managed detection and response service provided by Artemis.

• Manage security cases from initiation to resolution.

• Determine the events that transpired, assess the impact and blast radius, establish verdict and severity, and document the rationale.

• Reconstruct attacker activities using identity, cloud, endpoint, and SaaS telemetry.

• Investigate initial access, lateral movement, persistence, and data exfiltration.

• Integrate AI-assisted investigation techniques with hands-on log analysis.

• Suggest and implement containment measures within the authorized limits of each customer.

• Evaluate and anticipate the consequences of response actions before implementation, ensuring actions can be reversed.

• Provide customers with recommended actions, a comprehensive impact assessment, and clear next steps when their approval is necessary.

• Acknowledge cases and reach conclusions within response timelines based on severity levels.

• Prioritize significant tasks based on associated risks.

• Communicate case summaries, reasoning, and final analyses directly to customers.

• Conduct hypothesis-driven and AI-assisted threat hunts across client environments.

• Convert threat-hunting discoveries into new cases and detection mechanisms.

• Assist in developing investigative standards, response workflows, customer reports, and the analyst console.

• Contribute verdicts, reasoning, and recognized patterns to enhance detection engineering and product advancements.

⛳️ Requirements

• Minimum of 4 years of practical security operations experience in a SOC, MSSP, or MDR setting.

• Experience at a Senior or Tier 3 level where investigations concluded with the individual’s decision.

• Demonstrated depth of investigation in identity platforms: Okta and Entra ID.

• Proven depth of investigation in cloud platforms: AWS, Azure, and GCP.

• Established depth of investigation in endpoint detection and response (EDR) systems.

• Proven depth of investigation in SaaS platforms: Microsoft 365 and Google Workspace.

• Comprehensive understanding of attacker tactics, techniques, and procedures (MITRE ATT&CK).

• Strong investigative judgment based on evidence.

• Hands-on experience with AI-assisted investigation or automation tools.

• Customer-facing experience in explaining current security situations and proposed actions.

• Exceptional written communication skills.

• Willingness to work a defined shift as analyst coverage extends to 24x7.

• Bonus: Experience in a multi-tenant MDR or MSSP environment.

• Bonus: Experience in writing or fine-tuning detection rules using Sigma, YARA-L, SPL, KQL, or similar languages.

• Bonus: Incident command experience, including briefings for customer executives.

• Bonus: Background in dedicated threat hunting or DFIR.

• Bonus: Daily hands-on experience with AI or agentic coding tools for personal tooling development.

🏝️ Benefits

• Independence to lead investigations, influence platform development, and take ownership of outcomes.

• An environment that promotes open communication, mentorship, and continuous learning.

• Opportunity to contribute to shaping the service, investigative standards, response workflows, customer reports, and analyst console as a foundational analyst.

• Broad exposure to various cloud, identity, endpoint, SaaS environments, and attacker behaviors.

• Chance to work with AI-driven cybersecurity technologies.

• Opportunities for rapid learning and development.

• Meaningful work that protects real companies and their employees.

• A culture of innovation focused on customer satisfaction, speed, quality, mentorship, and learning.