Sr Information Security Analyst

Description Overview Senior individual contributor in Cyber Defense responsible for leading security investigations, incident response, threat detection and hunting, and continuous improvement of enterprise security operations. Works across endpoint, identity, email, cloud, and data security technologies to identify, contain, and remediate threats. Hands-on lead for complex investigations; improves detections/response, mentors analysts, and owns key Cyber Defense capabilities. DLP/data security experience strongly preferred. Scope of the Role Security Operations & Incident Response Lead investigation, containment, remediation, and post-incident review across endpoint, identity, email, cloud, and network. Investigate suspicious activity using SIEM, EDR/XDR, identity, email security, and other telemetry. Create incident timelines; determine scope/root cause; document findings; communicate risk/recommendations. Conduct proactive threat hunting to improve detection/response coverage. Serve as escalation point and mentor. Detection, SIEM & Automation Develop/tune security detections and correlation logic. Use SIEM to investigate, hunt, and improve monitoring coverage. Support orchestration/automation (playbooks for investigation, enrichment, containment, notification). Identify SOC processes to automate/streamline. Endpoint, Identity & Cloud Threat Detection Investigate endpoint threats (CrowdStrike Falcon or comparable EDR/XDR). Investigate identity-based attacks (AD, Microsoft Entra ID, auth, privileged accounts, OAuth apps, session/token abuse). Analyze Microsoft 365/cloud events and coordinate containment/remediation. Use TI/IOCs to scope incidents and proactively hunt. Data Security & DLP Support/improve enterprise DLP and data security monitoring across endpoint, email, cloud, collaboration. Investigate data-loss/sensitive exposure/policy violations; coordinate response. Tune DLP policies/workflows to improve quality and reduce business impact. Partner with security, privacy, legal, business as needed. Cyber Defense Program Improvement Identify gaps from incidents/threat hunting/analysis and recommend improvements. Develop/maintain investigation procedures, response playbooks, and documentation. Collaborate with engineering/IAM/network/cloud teams to strengthen controls. Own assigned Cyber Defense technologies/operational capabilities and drive maturity. Experience Required Bachelor’s in Cybersecurity/IT (or related) or equivalent experience. 7+ years relevant cybersecurity experience (hands-on security ops, incident response, detection, or hunting). Ability to independently lead complex incident investigations. Hands-on SIEM and EDR/XDR experience. Strong understanding of endpoint, identity, network, email, and cloud attack techniques. Working knowledge of Active Directory and Microsoft Entra ID security. Strong analytical/troubleshooting/documentation/communication skills. Desired Technical Experience CrowdStrike Falcon (EDR and/or Identity Protection). Splunk Enterprise Security, CrowdStrike Next-Gen SIEM, Microsoft Sentinel, or comparable SIEM. Cortex XSOAR or comparable SOAR/security automation. Microsoft 365/Entra ID security investigations. Enterprise DLP/data security (Proofpoint, Microsoft Purview, or similar). Email security and account-takeover investigations. PowerShell/Python/SPL/KQL or similar scripting/query languages. Threat intelligence, vulnerability/exposure management, hybrid enterprise environments. Benefits Competitive compensation; benefits to support you and your family; career development opportunities. Hybrid working: ability to work two days per week from home in many roles. #J-18808-Ljbffr