Senior Security Operations Analyst

Position Overview

As a Senior Security Operations Analyst ,you will serve as a technical subject matter expert and primary escalation point for the security operations team. In this role, you will drive theinvestigation and containment of complex security incidents with little to no direction, taking on themost complicated technical tasks. You are responsible for driving process and technology changeswithin our current framework to improve detection and response capabilities. You will ensure that allsecurity solutions are production-ready, scalable, and resilient. A key part of your role involvesproviding mentorship and technical coaching to Analysts and Associate Analysts, elevating team capabilities and ensuring adherence to established response standards across the cloud infrastructure and engineering teams.

How You Can Make an Impact

• Analyze and Validate Incidents: Perform advanced analysis of escalated security anomalies and events, ensuring the quality of the team's security controls and infrastructure meets organizational standards.
• Understand Scope & Affected Systems: Leverage threat intelligence (indicators of compromise, updated rules) to reconstruct attack timelines and map out impacted cloud workloads or systems.
• Design and implement complex containment strategies: Design and implement complex containment strategies and automated response playbooks, ensuring solutions are production-ready, deployable, and high-performance.
• Coordinate Strategic Mitigation: Assist in coordinating with cross-functional technical team to eradicate active threats and ensure system restoration.
• Manage Response Timelines: Assist in driving incident containment and meticulously document all response steps, investigative data, and timelines in our incident management platform (FireHydrant).
• Mentorship & Guidance: Provide technical mentorship and coaching to Analysts and Associate Analysts, helping to elevate team capabilities and ensuring consistent adherence to response processes.
• Process Improvement: Drive process and technology changes to improve efficiency and security efficacy, proactively identifying deficiencies and recommending enhancements to detection logic.
• Conduct Post-Incident Analysis: Participate in post-incident analysis, assist in determining root causes, and contribute to reports sharing lessons learned with system owners.

Requirements

• Professional Experience: 5+ years of professional hands-on experience in security operations, dedicated incident response, or related technical cyber defense environments.
• Technical Investigation: Demonstrated capability in evaluating security logs, analyzing indicators of compromise (IoCs), and performing secondary threat assessments.●
• Core Security Mindset: Solid understanding of fundamental security concepts, including network protocols, operating systems, IAM, endpoint protection, and the OSI model.
• Analytical Problem Solving: Highly analytical with a proven ability to think critically, multitask, and design tactical remediation strategies under pressure during high-severity events.
• Collaborative Communication: Excellent written and verbal communication skills, with the ability to convey complex incident scopes simply and concisely when coordinating with system owners. Ability to work across teams to research solutions.
• Autonomy & Planning: Ability to plan, estimate, and manage your own work over multiple sprints with little to no direction. Accountable for delivering solutions that are production-ready, scalable, and resilient.
• Technical Depth: Focused on taking on the most complicated technical tasks, including advanced threat hunting, forensic analysis, or complex incident response across cloud and on-prem environments.
• Operational Standards: Strong commitment to shared accountability, attention to detail, and a structured, team-oriented approach to cybersecurity.

Nice to Have

• Experience with cloud platforms (GCP preferred) and container orchestration security concepts (Docker, Kubernetes).
• Familiarity with scripting (Python, Bash) or managing detection-as-code and automated response playbooks.
• Hands-on experience with core security systems such as CrowdStrike Falcon, Okta, and Zscaler.
• Prior experience navigating and querying SIEM/SOAR suites (Google SecOps).
• Understanding of retail-specific threat landscapes and standard compliance frameworks (e.g., PCI DSS, SOC2).