Analyst, Threat Detection and Response

Job Description

Key Responsibilities

The Role

This position serves as a threat detection and response analyst with day to day focus on alert triage, detection, incident response, and threat hunting. The role supports a global organization with team members in North America, EMEA, and APAC regions.

This role is designed for an analyst building foundational expertise in threat detection and incident response. The successful candidate will work under the guidance of senior team members, develop proficiency across the incident lifecycle, and progressively take on more complex investigations as their skillset grows. A strong foundation in IT, networking, or systems administration is ideal.

Key Responsibilities

• Investigate security alerts and events, triage to determine scope and severity, and escalate to senior analysts when appropriate
• Support root cause analysis under senior analyst guidance, helping identify attack vectors and affected systems
• Execute defined incident response actions under guidance, including initial containment steps, evidence preservation, and supporting eradication and recovery efforts
• Coordinate with IT stakeholders, as directed, to support response actions and threat remediation
• Participate in threat hunting operations across a global, distributed technology environment
• Hunt for indicators of compromise and suspicious activity in logs, network traffic, and endpoint telemetry, using help refine hunting procedures and playbooks
• Assist with tuning SIEM/EDR detection rules and thresholds, and help identify opportunities to automate repetitive response actions
• Stay current on new vulnerabilities and adversary tactics relevant to ongoing investigations
• Work closely with global TDR team members and collaborate with colleagues in other regions (e.g. joint investigations or hand-offs) to ensure seamless coverage and knowledge sharing
• Document investigation steps, findings, and actions taken for each incident in a clear and concise manner, and contribute to incident reports and post-incident review meetings
• Assist in developing and updating incident response playbooks, standard operating procedures, and knowledge base documentation.
  
  

Key Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or equivalent practical experience in IT or security operations
• Certifications such as Security+, Network+, A+ or equivalent are a plus; willingness to pursue certifications is expected
• 2-3 years of experience in one or more or the following disciplines:
• Threat Detection & Analysis (leveraging SIEM tools, IDS/IPS, endpoint detection, log analysis, etc.)
• Incident Response & Management (developing response plans, executing playbooks, forensic investigations, root cause analysis)
• Threat Hunting (identifying undetected threats through proactive analysis and hypothesis-driven investigation)
• Cyber Threat Intelligence (gathering and analyzing threat intelligence to inform detection capabilities and preventive measures)
• Network Security (TCP/IP protocols, firewalls, intrusion prevention systems, and network traffic analysis)
• Exposure to securing and monitoring operating system and cloud environments (AWS, Azure, GCP), including reviewing cloud service logs and configurations for suspicious activity
• Demonstrated ability to:
• Function as a Level 1 or Level 2 Analyst (triaging and responding to cybersecurity alerts and incidents)
• Preferred Experience:
• Experience with automation tools and some proficiency in shell scripting languages (e.g., Python, PowerShell) to automate repetitive tasks and streamline investigations