• Work AI-enriched alerts, telemetry, and threat feeds to identify and remediate incidents. 

• Build and maintain agentic tooling and automations across the security stack, automating alert triage, enrichment, and analysis and reducing manual work for the team. 

• Build and maintain SOAR workflows that integrate SIEM, EDR, identity, email, and ticketing tools to automate enrichment, containment, and case management. 

• Lead technical investigation, containment, and recovery for security incidents alongside IT, engineering, and business teams, and turn root-cause findings into stronger detections, playbooks, and controls. 

• Author and tune detections, correlation rules, and queries, drafting them with AI from the threat behaviors you want to catch and validating before they go live. 

• Prioritize and drive remediation of vulnerability, pentest, and security-assessment findings across the organization. 

• Routinely assess network and cloud security posture and prioritize gaps against best practices. 

• Configure and maintain security devices, systems, and tooling according to best practices. 

• Investigate and respond to phishing reports and quarantine-release requests. 

• Own and enhance JSSI's Security Awareness Training program. 

• Design, implement, and operate security improvements across the environment to continually raise the organization's security posture and program maturity. 

• Establish and report on key security metrics and respond to audit requests and client due-diligence questionnaires. 

• Document and improve operational procedures, runbooks, and SOPs. 

• Contribute to incident response planning, security policies, disaster recovery, and business continuity planning. 

• Collaborate with other IT professionals to advise on cybersecurity best practices. 

• Participate in the on-call rotation and respond to critical security alerts off-hours. 

• Perform other duties as assigned. 

Required 

• 7+ years' experience in Information Technology roles, including 4+ years in security operations (SOC analyst, incident response, detection engineering, or similar). 

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent professional experience. 

• In-depth knowledge of networking protocols and experience configuring network security devices such as firewalls and IDS/IPS. 

• Experience with EDR and XDR services. 

• Scripting and query language experience such as Bash, PowerShell, and KQL. 

• Hands-on experience setting up and querying SIEM tools such as Sumo Logic. 

• Hands-on experience building automations and playbooks in a SOAR platform, integrating security tooling via APIs to automate triage, enrichment, and response. 

• Knowledge of data privacy and compliance regulations and cybersecurity frameworks such as ISO 27001 and NIST. 

• Excellent written and verbal communication skills. 

• Detail orientation and strong analytical and problem-solving abilities. 

• Ability to effectively prioritize tasks and projects in a fast-paced environment. 

Preferred 

• Experience with Tines. 

• Experience with the Microsoft Defender security suite. 

• Cybersecurity certifications such as CISSP, CISM, or CEH.