Worker Type
Regular
Job Description
Summary
The Senior Cybersecurity Analyst leads the investigation, containment, and remediation of cybersecurity incidents across the organization. This role serves as a technical escalation point for complex security events, coordinates response activities with IT, engineering, legal, and business stakeholders, and provides guidance to less-experienced analysts. The ideal candidate has strong expertise in endpoint and network forensics, SIEM and EDR technologies, threat hunting, incident leadership, and security automation.
Position Responsibilities
Lead complex cybersecurity investigations from initial triage through containment, eradication, recovery, and closure, ensuring timely execution and thorough documentation.
Serve as the primary technical lead for escalated security incidents, establishing investigation priorities, assigning tasks, and coordinating response activities across analysts and technical teams.
Analyze endpoint, identity, email, network, and cloud telemetry to determine incident scope, attack vectors, affected assets, adversary activity, and potential business impact.
Develop incident timelines and identify root causes, persistence mechanisms, lateral movement, and indicators of compromise.
Collect, preserve, and analyze digital evidence in accordance with established evidence-handling, chain-of-custody, and retention procedures.
Coordinate containment and remediation with IT, engineering, application owners, and business stakeholders, balancing incident urgency with operational requirements.
Investigate phishing, account compromise, malware, ransomware, unauthorized access, data exfiltration, and suspected insider threats within approved investigative authority.
Use Microsoft Sentinel, Microsoft Defender, and other security platforms to correlate alerts, develop investigative queries, and validate findings.
Conduct threat hunting based on incident findings, threat intelligence, and adversary techniques to identify previously undetected activity.
Maintain accurate incident records and provide clear technical findings, executive summaries, status updates, and actionable recommendations.
Escalate significant incidents through established channels and coordinate with leadership, Legal, Human Resources, Privacy, and Compliance as appropriate.
Lead post-incident reviews, identify control gaps, and track corrective actions through verified completion.
Develop and maintain investigation playbooks, response procedures, escalation criteria, and evidence-collection guidance.
Partner with security engineers to improve detection coverage, reduce false positives, and automate repeatable investigative and response tasks.
Mentor analysts, review investigation quality, and strengthen team capabilities through case reviews, exercises, and knowledge sharing.
Participate in the on-call rotation and lead after-hours response to critical security incidents as required.
Basic Qualifications (Required Skills & Experience)
5+ years of experience in cybersecurity incident response, security operations, digital forensics, or related discipline.
Demonstrated experience leading the investigation and response of complex security incidents, including: Ransomware and malware, Phishing and business email compromise, Account compromise and credential theft, Insider threats, Data exfiltration, Unauthorized access and privilege escalation
Strong knowledge of incident response processes, including preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
Experience using security technologies such as: SIEM platforms, Endpoint Detection and Response (EDR) tools, Network monitoring and intrusion detection systems, Vulnerability management platforms, Digital forensic and malware analysis tools
Proficiency analyzing all Operating System logs, authentication logs, network traffic, endpoint telemetry, and cloud security events.
Knowledge of common attack techniques and…