Job Description
Position Summary
\n
Security operations resource supporting multiple complex, systemwide business services. This role sits at the tier-2/tier-3 level: deep-dive threat analysis, detection engineering, and forensic incident response — not alert triage. The person in this seat is expected to independently own investigations end to end, validate and tune a newly implemented SIEM, and serve as an escalation point and technical mentor for less experienced analysts.
\n
\n
Duties
\n
- \n
- Lead deep-dive threat analysis across IP, telephony, email, web, and software-package threat intelligence sources (Google Threat Intelligence, Twilio, VirusTotal, and others), turning intelligence into actionable detections and response.
- Serve as tier-2/tier-3 escalation for security incident detection, response, containment, resolution, and recovery — including forensic analysis, security event analysis, data collection, packet analysis, and ticket management.
- Validate, tune, and mature detection content in CrowdStrike NG-SIEM (currently being implemented); confirm coverage, reduce false positives, and close visibility gaps.
- Perform large-scale log analysis and correlation using S3, Athena, and related tooling across AWS (WAF, RDS, security groups), F5, network logs, PeopleSoft HCM, Pathlock (SSO, A360, SoD), Entrust, and other enterprise systems.
- Administer and maintain one or more security services (SIEM, vulnerability management, threat detection, phishing, DLP), including patching, configuration changes, troubleshooting, and customer requests.
- Prioritize and drive resolution of security issues with material financial or regulatory impact, including SOX-relevant systems and controls.
- Analyze, report, and remediate findings from vulnerability scans and penetration tests; track risk acceptance and remediation to closure.
\n
\n
\n
\n
\n
\n
\n
\n
\n
Required Skills / Experience
\n
- \n
- 3+ years on an IT security operations / incident response team in a senior analyst, engineer, or systems administrator capacity, including demonstrated ownership of complex investigations without supervision.
- Deep forensic and incident response analysis of complex business systems.
- Hands-on experience with modern SIEM platforms — implementation, tuning, detection engineering, and content development. CrowdStrike NG-SIEM or equivalent next-gen platform strongly preferred.
- Substantial AWS security experience: WAF, security groups, RDS, CloudTrail/log pipelines, S3 and Athena for large-scale log analysis.
- Applied threat intelligence experience across multiple source types (IP, email, telephony, domain/file reputation) and the ability to operationalize it.
- Knowledge of security best practices across Linux, Windows, macOS, VMware, and Cisco IOS — including OS security tooling, configuration, logging, and patching.
- Working knowledge of public-key cryptography and best practices for protecting data at rest and in transit.
- Strong scripting ability (Python, PowerShell, Bash, or equivalent) for automation and data analysis.
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
Preferred Skills / Experience
\n
- \n
- Background or formal education in data science; demonstrated use of statistical or data-driven methods in threat hunting and anomaly detection.
- Experience using AI/LLM tooling as an engineering aid for log analysis, correlation, and investigation acceleration.
- Experience supporting ERP/HCM environments (PeopleSoft HCM) and access governance tooling (Pathlock, SoD, SSO).
- Working knowledge of security audit processes, SOX controls, and related expectations.
- Bachelor's degree in CS, IT, CIS, or a related field. Professional certifications (CISSP, GCIA, GCIH, GCFA, Security+, CCNA) will weigh in the candidate's favor.
\n
\n
\n
\n
\n
\n