Senior SOC Analyst — Advanced Incident Response & CrowdStrike Engineering

About This RoleThis is a individual contributor role and the technical backbone of Biogen's Security Operations Center — an analyst who leads complex incident investigations, engineers and optimizes the CrowdStrike Falcon platform across advanced modules (AIDR, Data Security, NG-SIEM, Identity Protection), and extends detection capabilities into operational technology (OT) environments supporting pharmaceutical manufacturing.You will own the most complex escalations, build the detection logic that catches what others miss, and serve as the bridge between IT security operations and OT/manufacturing environments. This is not a monitoring role — it is an engineering and investigation role that happens to sit in the SOC.Why This Role ExistsBiogen's threat landscape demands deeper investigative capability — advanced persistent threats, insider risk, and pharmaceutical IP targeting require an analyst who can conduct full-spectrum forensic investigations and threat huntingCrowdStrike Falcon is our primary detection and response platform — we need an engineer who can maximize the value of AIDR, Data Security, NG-SIEM (LogScale), and Identity Protection modules beyond default configurationsIT/OT convergence in our manufacturing environments creates unique detection challenges — DeltaV/DCS systems, GxP-regulated processes, and industrial protocols require specialized security monitoringKey ResponsibilitiesAdvanced Incident Response & Investigations (40%)Lead complex, multi-stage incident investigations from initial detection through containment, eradication, recovery, and lessons learnedConduct deep-dive forensic analysis: memory forensics (Volatility), disk forensics, network artifact analysis, and malware triage to determine attacker TTPsPerform kill chain reconstruction — map attacker activity to MITRE ATT&CK, identify lateral movement paths, persistence mechanisms, and data staging/exfiltration techniquesDevelop and execute proactive threat hunts based on intelligence, behavioral anomalies, and hypothesis-driven analysis across endpoint, network, identity, and cloud telemetryProduce actionable incident reports with root cause analysis, business impact assessment, and concrete remediation recommendationsCrowdStrike Falcon Platform Engineering (35%)Engineer, tune, and operationalize these Falcon modules:NG-SIEM (LogScale)Develop and maintain CQL (CrowdStrike Query Language) queries for advanced correlation, threat hunting, and detection rulesBuild custom dashboards, scheduled searches, and automated alerting pipelinesOptimize log ingestion, parsing, and retention policies across all telemetry sourcesCreate detection-as-code workflows — version-controlled queries that map to MITRE ATT&CK coverage gapsAIDR (AI Detection & Response)Configure and tune AI-driven detection policies for prompt injection, data leakage, and shadow AI usageBuild custom rules to monitor GenAI application interactions across endpoints and cloud workloadsAssess and respond to AI-specific threats: model poisoning indicators, unauthorized AI tool installations, sensitive data in AI promptsIntegrate AIDR telemetry into investigation workflows and incident playbooksIdentity ProtectionEngineer identity-based detection rules: Kerberoasting, credential stuffing, lateral movement via pass-the-hash/ticket, suspicious service account behaviorConfigure conditional access policies, risk-based authentication enforcement, and identity threat hunting queriesMonitor Active Directory attack paths and privilege escalation techniques (DCSync, Golden Ticket, NTLM relay)Coordinate with IAM team on identity hygiene findings and remediation prioritiesData Security (Data Protection)Configure data classification policies and egress monitoring rules for sensitive content (IP, PII, regulated data)Tune anomaly detection for unusual data movement patterns: bulk downloads, new destination usage, abnormal upload volumesBuild response workflows for data exfiltration alerts — user notification, manager escalation, automatic evidence preservationDefine and enforce policies for removable media, cloud storage, and web upload channelsPlatform AdministrationManage sensor deployment health, prevention policies, and RBAC across 25,000+ endpointsDevelop custom IOA (Indicator of Attack) rules and behavioral detections tailored to Biogen's environmentBuild and maintain Falcon Fusion (SOAR) workflows for automated containment and enrichmentCoordinate with CrowdStrike OverWatch for managed hunting findings and recommended actionsOT/ICS Security Operations (25%)Extend SOC monitoring into operational technology environments supporting pharmaceutical manufacturing (DeltaV DCS, SCADA, PLCs, HMIs)Develop and tune detection rules for OT-specific threats: unauthorized engineering workstation access, controller logic changes, anomalous industrial protocol traffic (Modbus, EtherNet/IP, OPC-UA)Maintain and enforce IT/OT network segmentation aligned with the Purdue Reference Model — monitor for segmentation bypass attemptsLead incident response for OT security events in coordination with Process Automation, Engineering, and Plant Operations teamsSupport OT asset inventory maintenance and vulnerability management in GxP-regulated environments (21 CFR Part 11, cGMP considerations)Conduct tabletop exercises for OT-specific scenarios (ransomware impacting batch processing, unauthorized remote access to control systems)Required QualificationsExperienceBachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field required; advanced degree preferred3-5+ years in Security Operations, Incident Response, or Threat Hunting with progressive responsibility3+ years hands-on experience with CrowdStrike Falcon platform in an engineering/administration capacity (not just alert triage)Demonstrated experience leading complex incident investigations involving APT, ransomware, insider threats, or supply chain compromiseExperience with OT/ICS security monitoring, industrial environments, or manufacturing cybersecurityTrack record of building detection rules, SIEM correlation logic, or behavioral analytics that caught real threatsTechnical SkillsCrowdStrike Falcon: NG-SIEM (LogScale/CQL), AIDR, Identity Protection, Data Security, Falcon Fusion, Real Time Response, custom IOA developmentForensics: memory analysis (Volatility), disk forensics, network forensics, malware triage/reverse engineering fundamentalsThreat Hunting: hypothesis-driven hunts, MITRE ATT&CK mapping, behavioral analysis across endpoint/network/identity/cloud telemetryScripting & Automation: Python and PowerShell for investigation tooling, data parsing, API integrations, and SOAR playbook developmentNetwork Security: deep understanding of TCP/IP, DNS, lateral movement protocols (SMB, RDP, WMI, WinRM), and packet analysisIdentity Security: Active Directory attack techniques, Kerberos/NTLM fundamentals, privilege escalation paths, identity-based detectionOT/ICS: familiarity with industrial protocols (Modbus, EtherNet/IP, OPC-UA), Purdue Model architecture, DCS/SCADA security principlesCertifications (Preferred — not all required)CrowdStrike: CCFA (Falcon Administrator), CCFR (Falcon Responder), CCFH (Falcon Hunter)SANS/GIAC: GCFA, GCIH, GREM, GCIA, or GNFAOT/ICS: GICSP (Global Industrial Cyber Security Professional) or GRID (Response and Industrial Defense)General: CISSP, CySA+, or equivalentPreferred QualificationsExperience in pharmaceutical, biotech, or life sciences environments with GxP-regulated systemsFamiliarity with DeltaV DCS, batch automation systems, or laboratory automation securityExperience with CrowdStrike NG-SIEM migration, parser development, or LogScale administrationBackground in detection engineering as code (version-controlled detections, CI/CD for security content)Experience coordinating with CrowdStrike OverWatch or similar managed hunting servicesJob Level: ManagementAdditional InformationThe base compensation range for this role is: $115,000.00-$154,000.00Base salary offered is determined through an analytical approach utilizing a combination of factors including, but not limited to, relevant skills & experience, job location, and internal equity.Regular employees are eligible to receive both short term and long-term incentives, including cash bonus and equity incentive opportunities, designed to reward recent achievements and recognize your future potential based on individual, business unit and company performance. In addition to compensation, Biogen offers a full and highly competitive range of benefits designed to support our employees’ and their families physical, financial, emotional, and social well-being; including, but not limited to:Medical, Dental, Vision, & Life insurancesFitness & Wellness programs including a fitness reimbursement Short- and Long-Term Disability insuranceA minimum of 15 days of paid vacation and an additional end-of-year shutdown time off (Dec 26-Dec 31)Up to 12 company paid holidays + 3 paid days off for Personal Significance 80 hours of sick time per calendar yearPaid Maternity and Parental Leave benefit 401(k) program participation with company matched contributionsEmployee stock purchase plan Tuition reimbursement of up to $10,000 per calendar year Employee Resource Groups participationWhy Biogen?We are a global team with a commitment to excellence, and a pioneering spirit. As a mid-sized biotechnology company, we provide the stability and resources of a well-established business while fostering an environment where individual contributions make a significant impact. Our team encompasses some of the most talented and passionate achievers who have unparalleled opportunities for learning, growth, and expanding their skills. Above all, we work together to deliver life-changing medicines, with every role playing a vital part in our mission. Caring Deeply. Achieving Excellence. Changing Lives.At Biogen, we are committed to building on our culture of inclusion and belonging that reflects the communities where we operate and the patients we serve. We know that diverse backgrounds, cultures, and perspectives make us a stronger and more innovative company, and we are focused on building teams where every employee feels empowered and inspired. Read on to learn more about our Biogen.All qualified applicants will receive consideration for employment without regard to sex, gender identity or expression, sexual orientation, marital status, race, color, national origin, ancestry, ethnicity, religion, age, veteran status, disability, genetic information or any other basis protected by federal, state or local law. Biogen is an E-Verify Employer in the United States.SummaryLocation: Research Triangle Park, NCType: Full time