Senior Security Analyst (MDR)

Accountabilities:

• Own security investigations from initial case pickup through resolution, determining what happened, assessing impact and blast radius, assigning verdicts and severity, and documenting the reasoning behind each decision.
• Conduct in-depth investigations across identity, cloud, endpoint, and SaaS telemetry, reconstructing attacker activity including initial access, lateral movement, persistence, and exfiltration.
• Combine AI-assisted investigation capabilities with hands-on log and evidence analysis, applying sound judgment to determine when automation is reliable and when deeper manual investigation is required.
• Recommend and execute containment actions within customer-authorized boundaries, ensuring actions are evaluated for impact and reversibility before execution and clearly communicating recommended next steps when customer approval is required.
• Prioritize investigations according to risk, meeting response targets for incidents of different severity levels and ensuring the most consequential security issues receive appropriate attention.
• Act as a trusted security partner to customers by clearly explaining incidents, implications, recommended actions, and final analysis through concise and thoughtful written and verbal communication.
• Conduct hypothesis-driven and AI-assisted threat hunts across customer environments, turning new findings into actionable cases, improved detections, and stronger defensive coverage.
• Help define and evolve the MDR service by contributing to investigative standards, response workflows, customer reporting, analyst processes, and the tools used by the security team.
• Feed investigation outcomes, analytical reasoning, and identified attack patterns back into detection engineering and product development so recurring security problems can be addressed systematically.

Requirements

• 4+ years of hands-on security operations experience within a SOC, MSSP, or MDR environment, ideally at a senior or Tier 3 level where you have independently owned investigation outcomes and security decisions.
• Proven ability to investigate threats across identity platforms such as Okta and Entra ID, cloud environments including AWS, Azure, and GCP, endpoint detection and response systems, and SaaS platforms such as Microsoft 365 and Google Workspace.
• Strong understanding of attacker tactics, techniques, and procedures, including the ability to apply the MITRE ATT&CK framework to real-world security telemetry and investigations.
• A rigorous, evidence-driven approach to analysis, with the ability to distinguish suspicious activity from confirmed threats and identify the evidence required to confidently reach a conclusion.
• Hands-on experience with AI-assisted security investigation or automation, together with the judgment to understand its strengths, limitations, and appropriate areas of human oversight.
• Strong customer-facing communication skills and experience guiding stakeholders through active security incidents, explaining what is happening, why it matters, and what should happen next.
• Excellent written communication skills, with the ability to produce clear, accurate, customer-ready investigation summaries and recommendations.
• A high standard for analytical quality, accountability, and professional judgment, with a willingness to have the quality of your work measured against clear expectations.
• Ability to work within defined shifts as analyst coverage expands to a 24/7 operating model.
• Experience in a multi-tenant MDR or MSSP environment is an advantage, particularly where you have supported multiple customer environments simultaneously.
• Experience writing or tuning detection rules using technologies such as Sigma, YARA-L, SPL, KQL, or similar is highly valued.
• Incident command experience, including customer-facing executive briefings, as well as dedicated threat hunting or DFIR experience, is a plus.
• Experience using AI or agentic coding tools to develop internal security tooling and improve analyst workflows is an additional advantage.

Benefits

• Fully remote work model with opportunities available across the United States, as well as other international locations.
• Opportunity to join an early-stage security operation and have a meaningful influence on how the MDR service, standards, workflows, and customer experience are built.
• Exposure to a broad range of customer environments, technologies, and attacker behaviors, enabling accelerated development of modern security expertise.
• Direct opportunity to work with AI-native security technology and help shape the future of automated security operations.
• High-impact work focused on protecting real organizations and their users against active cyber threats.
• Close collaboration with experienced software engineers, AI researchers, security engineers, and product professionals.
• An environment that emphasizes customer obsession, high-quality execution, open communication, mentorship, continuous learning, and individual ownership.
• Opportunity to influence product and detection engineering by turning investigation insights into improvements that can benefit multiple customer environments.
• Full-time employment with a fast-moving, technically ambitious environment designed for professionals who want significant responsibility and autonomy.