Want to know if this job is worth applying to?
София, София-град, България
Remote only
At DraftKings, AI is becoming an integral part of both our present and future, powering how work gets done today, guiding smarter decisions, and sparking bold ideas. It’s transforming how we enhance customer experiences, streamline operations, and unlock new possibilities. Our teams are energized by innovation and readily embrace emerging technology. We’re not waiting for the future to arrive. We’re shaping it, one bold step at a time. To those who see AI as a driver of progress, come build the future together.
As a Senior Security Analyst, you'll lead investigations that protect our customers and the systems behind DraftKings, working across corporate and production environments. In this role, you'll operate as the senior escalation point, working across endpoint, identity systems, cloud environments, and production workloads. You'll own our most complex investigations, navigate incidents without an established playbook, and strengthen how the team responds while mentoring other analysts.
Lead security investigations across endpoint, identity systems, cloud environments, and production workloads, covering triage, root-cause analysis, containment, and eradication.
Act as incident commander in your region, coordinating parallel work across IT, Engineering, Legal, HR, and other teams.
Investigate cases with no existing playbook: decide what data to collect, build the tools to analyze it, and document it for reuse.
Write and peer-review case summaries, incident reports, and timelines.
Hunt for novel threats, such as AI-assisted intrusions or supply-chain compromise. Convert findings into telemetry, detections, and automation that raise alert quality and reduce manual work.
Drive post-incident hardening with Security Engineering and mentor analysts through case review, escalation support, and knowledge sharing.
At least 6 years in cybersecurity, including 4 or more years in incident response, forensics, threat intelligence, or threat hunting.
Experience running major incidents with little supervision, under time pressure and incomplete facts, including briefing leadership and writing the post-incident reports for both engineers and executives.
Deep knowledge of how attackers operate today, including insider threat, and the frameworks such as MITRE ATT&CK, the Diamond Model, the kill chain, with the ability to assess an attacker’s capabilities as an investigation unfolds..
Hands-on experience with SIEM, EDR/NDR, and CSPM tooling.
Monitoring experience in endpoint, identity, SaaS or CI/CD environments, including incident investigation in at least one major cloud environment, such as AWS, Azure, or GCP.
Practical scripting skills in Python, PowerShell or a similar language, with experience utilizing YARA-L, Sigma, KQL, SPL or similar for investigation queries and detections.
#LI-TK1
#LI-REMOTE
We’re a publicly traded (NASDAQ: DKNG) technology company headquartered in Boston. As a regulated gaming company, you may be required to obtain a gaming license issued by the appropriate state agency as a condition of employment. Don’t worry, we’ll guide you through the process if this is relevant to your role.