Senior Security Analyst, RAAS – Managed Services

This is a fully remote position, open to applicants in United States.

📋 Description

• Monitor alerts and incidents across client tenants utilizing Microsoft Sentinel and Microsoft Defender products.

• Triage incidents, verify automated enrichment, and adhere to acknowledgment and containment SLAs.

• Investigate suspicious sign-ins, high-risk users, and conditional access failures within Microsoft Entra ID.

• Develop and refine KQL queries for threat hunting, investigation, and detection rule creation.

• Initiate, approve, reverse, execute, and author automation rules and Logic Apps playbooks in Sentinel.

• Escalate confirmed incidents with detailed timelines and supporting documentation.

• Review, approve, reject, validate, and reverse automated containment actions.

• Oversee playbook health and maintain automation settings tailored to each client.

• Ensure client notifications accurately reflect the actions taken automatically.

• Identify potential areas for new automation and enhancements.

• Adhere to change control procedures using Sentinel Repositories/CI-CD.

• Inform clients of incidents through phone, email, or ticketing systems.

• Draft incident summaries and remediation suggestions for both technical and non-technical stakeholders.

• Contribute to monthly client security reports and participate in service reviews.

• Refine analytics rules, update runbooks and knowledge base articles, and monitor emerging threats.

• Engage in rotating after-hours, evening, weekend, and holiday on-call coverage to ensure 24/7 client protection.

• Maintain a reliable home internet connection and phone for remote shifts and on-call responsibilities.

⛳️ Requirements

• 3–4 years of experience in a SOC, MSSP, MDR, or IT security operations role.

• Hands-on experience with Microsoft Sentinel and Microsoft Defender XDR.

• Proficient knowledge of KQL.

• Strong understanding of Microsoft Entra ID, Microsoft 365, Windows endpoints, networking fundamentals, and common attack techniques (MITRE ATT&CK).

• Excellent written and verbal communication skills, maintaining composure and clarity during active client incidents.

• Willingness to work evenings, weekends, holidays, and participate in on-call rotations.

• Ability to work independently with minimal supervision.

• Familiarity with Sentinel automation rules, incident tasks, and playbook triggers (incident, alert, and entity triggers).

• Sound judgment on when to trust automation and when to intervene.

• Microsoft SC-200 certification is required.

• At least one of SC-300, AZ-500, AZ-104, or SC-401, or a commitment to obtain one within 90 days of hire.

• Experience managing multiple tenants simultaneously through Azure Lighthouse or Defender XDR multi-tenant management.

• Experience building Sentinel automation using Logic Apps, as well as PowerShell or Python scripting.

• Familiarity with Microsoft Security Copilot, Defender for Cloud, and Microsoft Purview.

• SC-401 or SC-100 certification is a plus.

• Vendor-neutral certifications such as CISSP are advantageous.

• Bachelor's degree in cybersecurity, IT, or a related field, or equivalent experience.

🏝️ Benefits

• Medical, Dental, and Vision Insurance from the first day of employment.

• Flexible Spending Account and Dependent Care Account.

• 401k with Profit Sharing.

• 9+ holidays and a discretionary time off structure.

• Parental Leave – coverage for both primary and secondary caregivers.

• Tuition Assistance Program and CPA support program with a cash incentive upon completion.

• Discretionary incentive compensation based on firm, group, and individual performance.

• Incentive compensation related to the origination of new client sales.

• Highly rated wellness program.

• Flexible working environment including remote and hybrid options.

• Competitive compensation.

• Industry-leading benefits.

• Flexible work environment to promote work/life balance.