We are a payment processor that handles very sensitive data for both our merchants and their customers. As we grow we need to make sure that our security is excellent and that our customer’s data is secure.
We are seeking a skilled and motivated Senior Security Analyst to serve as a technical anchor of our security operations team. You’ll lead investigations into complex threats, build the detections that catch them earlier next time, and raise the bar for how the whole team responds to incidents.
This is a hands-on role for someone who has outgrown pure alert triage and wants ownership: of detection quality, of incident outcomes, and of mentoring the analysts around you.
Responsibilities
- Lead investigation and response for high-severity security incidents, from initial detection through containment, eradication, recovery, and post-incident review.
- Design, tune, and maintain detection logic across our SIEM, EDR, and cloud security tooling, and retire the rules that generate noise instead of signal.
- Conduct proactive threat hunts based on threat intelligence, adversary TTPs, and anomalies in telemetry.
- Perform forensic analysis of endpoints, network traffic, and cloud environments to determine scope and root cause.
- Write and maintain runbooks, playbooks, and post-incident reports that make the next response faster.
- Partner with engineering and IT teams to close gaps surfaced by incidents and hunts, and to improve logging and telemetry coverage.
- Automate repetitive response steps through SOAR (Security Orchestration, Automation, and Response) workflows or scripting.
- Mentor junior analysts on investigation methodology, tooling, and escalation judgment.
- Contribute to tabletop exercises, purple team engagements, and control validation.
- Support audit and compliance evidence requests as they relate to security monitoring and incident response.
Requirements
- 5+ years of experience in security operations, incident response, threat hunting, or a closely related cybersecurity function.
- Experience managing outsourced SOC providers, including setting expectations, overseeing performance, and ensuring effective monitoring and incident response.
- Proven ability to build and scale security operations teams, including defining processes, roles, workflows, and operating procedures.
- Deep hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, or Elastic, including developing, tuning, and maintaining detection content.
- Strong expertise with EDR solutions and endpoint forensics, with the ability to investigate and respond to sophisticated endpoint threats.
- Strong understanding of attacker techniques and tradecraft, including practical application of frameworks such as MITRE ATT&CK.
- Solid technical foundation in networking, Windows and Linux operating systems, authentication, and identity management.
- Scripting and automation skills using Python, PowerShell, or similar languages to support security analysis, investigation, and operational efficiency.
- Excellent written and verbal communication skills, with the ability to clearly explain security incidents and technical risks to both engineering teams and executive stakeholders.
- Strong judgment and decision-making skills, particularly when operating under pressure, during active incidents, and with incomplete or ambiguous information.
Nice to haves
While not specifically required, tell us if you have any of the following.
- Experience securing cloud environments (AWS, GCP or Azure), including cloud-native logging and detection.
- Familiarity with containers and Kubernetes security.
- Experience with SOAR (Security Orchestration, Automation, and Response) platforms and detection-as-code workflows.
- Malware analysis or reverse engineering experience.
- Certifications such as GCIA, GCIH, GCFA, OSCP, CISSP, or equivalent practical experience
- Exposure to compliance frameworks relevant to our business (SOC 2, ISO 27001, PCI DSS, HIPAA).
