At Wursta, we believe technology should expand what people are capable of — not quietly erase what they are for. Buying the technology is the easy part; Wursta builds the operating system that turns technology investment into value you can measure — combining governance, workforce proficiency, and platform delivery, and then transferring the system to our clients' own teams. We specialize in digital transformation, cloud services, managed services, custom development, cybersecurity, and AI solutions to help organizations scale capabilities and increase productivity.
The Managed Security Services Operations (MSSP) Team functions as a Secure AI Augmented SOC, Software Engineering (AI Product Development), and Go-To-Market for Security services (Sales Enablement). This team functions within a specialized, cross-functional MSSP unit tailored for multi-tenant cloud environments (focusing on Google Workspace and Google Cloud Platform).
The team is structured to operate as a high-velocity, automation-first security team, moving away from traditional manual Level 1/Level 2 SOC escalation trees to an AI-driven, Tier-3 led model.
KEY RESPONSIBILITIES
The Lead Security Operations Analyst serves a dual-purpose operational and engineering role. As the primary tier-3 response authority and team lead, this individual oversees real-time threat monitoring, incident response, and SLA delivery across client tenants within the proprietary MSSP platform.
Simultaneously, this role acts as an AI Integration and Detection Engineer, leveraging modern AI development tools (e.g., Google Gemini and Anthropic Claude API) to architect automated escalation workflows and orchestrations, engineer high-fidelity detections, and integrate custom AI agents into the core MSSP application stack.
1. SECURITY MONITORING & INCIDENT RESPONSE (24/7 OPERATIONS LEAD)
- Threat Detection & Triage: Lead the operational triage, analysis, and prioritization of complex security events across multi-tenant client environments.
- Incident Response Leadership: Function as the Incident Commander during critical security events, adhering strictly to NIST SP 800-61r2 (Computer Security Incident Handling Guide) to execute containment, eradication, and recovery strategies.
- Threat Hunting & Detection Engineering: Utilize the MITRE ATT&CK Framework to map adversary tactics, techniques, and procedures (TTPs), proactive threat hunting, and writing custom correlation rules (e.g., Sigma, YARA).
- Client Advisory & SLA Enforcement: Ensure all incident notifications and responses meet contractual Service Level Agreements (SLAs) and regulatory reporting timelines.
2. MSSP APP AUTOMATION & AI DEVELOPMENT
- AI-Assisted Workflow Engineering: Utilize AI development environments and APIs to write clean, production-grade Python, Node.js, or Go code to extend the backend logic of the MSSP application.
- Third Party Tool Integrations: As needed, build integrations to meet Client needs for monitoring other security solution telemetry such as EDR solutions (CrowdStrike, SentinalOne, Etc), DNS Security Alerts, Threat Intelligence (GTI, etc), SPAM/Phishing solutions, IDM solutions (Okta, Jumpcloud, etc), Firewall/IDS alerts, and other related monitoring needs.
- Automated Escalation Playbooks: Design and build automated orchestration playbooks (SOAR) within the MSSP platform to execute dynamic triage, identity enrichment, and automatic tenant isolation.
- LLM & AI Integration: Implement AI-driven alert summarize-and-enrichment pipelines using LLM frameworks (e.g., Gemini models for internal threat databases, BigQuery SIEM data lakes, and third-party APIs via REST webhooks to construct dynamic Retrieval-Augmented Generation (RAG) pipelines, and MCP servers) to provide context-rich incident tickets for analysts and end-clients.
- Noise Reduction: Continuously optimize detection pipelines using machine learning and AI filters to reduce false positive alert volume.
3. COMPLIANCE, GOVERNANCE & MULTI-TENANT…