Associate Principal, Cyber Defense

What You’ll Do The Associate Principal, Cyber Defense is responsible for the in-depth analysis and response to security incidents escalated from Tier 1 analysts. The role involves investigating complex security events, identifying potential threats, and implementing measures to mitigate risks. The analyst leverages advanced threat intelligence and incident response techniques to maintain the organization’s security posture. Primary Duties and Responsibilities To perform this job successfully, an individual must able to perform each primary duty satisfactorily. Security Monitoring: Monitor security alerts and events from various security tools and technologies; perform advanced analysis of security logs, network traffic, and endpoint data. Incident Response: Review and respond to security incidents escalated by Tier 1 analysts; conduct thorough investigations to determine the scope and impact of incidents; implement containment, eradication, and recovery measures; document and report findings, actions taken, and lessons learned. Collaboration and Communication: Work closely with threat intelligence teams to enhance detection and response capabilities; collaborate with other security team members and IT staff to address incidents; provide guidance and support to Tier 1 analysts; communicate effectively with stakeholders regarding incidents and mitigation efforts. Continuous Improvement: Participate in post‑incident reviews to identify improvement areas; stay current with the latest cybersecurity trends, threats, and technologies; contribute to the development and enhancement of SOC processes and procedures. Supervisory Responsibilities None. Qualifications Proven team player, working primarily with staff members on both long‑term projects and rapid response under tight deadlines. Team leadership experience, taking initiative and following through on solutions across various skill sets. Knowledge and experience implementing controls based on security regulation (e.g., NIST Cyber Security Framework) is a plus. Excellent oral and written communication, analytical judgment, and consultation skills. Ability to communicate effectively, both formally and informally, at all management levels. Ability to work with local and remote IT staff/management, vendors, and consultants. Ability to work independently and possess strong project management skills. Technical Skills Log analysis and security content development in SIEM solutions (Splunk, IBM QRadar, LogRhythm, etc.). SOAR products such as Splunk SOAR, Cortex XSOAR, FortiSOAR; SOAR playbook development experience is a plus. Endpoint detection and response tools, e.g., CrowdStrike, SentinelOne, Microsoft Defender. Incident response playbook development, managing security incident analysis and remediation. Network‑based preventative and detective technologies (IDS/IPS, firewalls, proxy servers). Standard technical writing tools including MS Word, Excel, Project, and Visio. Familiarity With Vulnerability assessment tools (Qualys, Nessus, nmap, etc.). Directory services, LDAP, and their inherent security (Active Directory, CA Directory, Entra ID). Client/server platforms including Windows and Linux. Operating system hardening procedures (Solaris, Linux, Windows). Web Application Firewalls. Cloud‑based security tools and techniques (AWS, Azure, GCP). Experience and Education Minimum four years of information security experience, preferably in the financial services industry. Hands‑on security operations experience with three or more of: Cyber Threat Analysis, Incident Response, Application Security, Operating Systems Security, Cloud Engineering, Networking, Programming languages, AI Prompt engineering. Technical experience and comprehensive knowledge of threat actor capabilities, intentions, methodologies, and motives. Familiarity with computer network exploitation and network attack methodologies, and their relevance to the financial services industry and critical infrastructure. Industry knowledge of leading‑edge security technologies and methods. Shift work and on‑call availability for 24×7 support duties. Previous project management experience is a plus. Certificates or Licenses Strongly prefer at least one of the following certifications: CISSP, GCIA, GCIH, CHFI, GCFA, CASP+. Benefits Hybrid work environment, up to 2 days per week of remote work. Tuition reimbursement to support continued education. Student loan repayment assistance. Technology stipend for using a device of choice to connect to the network while working remotely. Generous PTO and parental leave. 401(k) employer match. Competitive health benefits (medical, dental, vision). Compensation The salary range is exclusive of fringe benefits and potential bonuses. Final base salary will be determined by skills, experience, and/or education. In addition, pay equity and internal equity are considered when making final offers. All employees may be eligible for a discretionary bonus based on company and individual performance. Salary Range $112,700.00 – $186,900.00 Incentive Range 8% to 15% Equal Opportunity Employer OCC is an Equal Opportunity Employer. Notes Only applications submitted through the OCC careers site will be considered. Unsolicited resumes and contacts from staffing agencies will not be accepted. Visa Sponsorship

THIS POSITION IS NOT ELIGIBLE FOR VISA SPONSORSHIP.