Information Security Analyst III

Senior Cybersecurity Operations Team Member

An individual contributor that serves as a senior member on the cybersecurity operations team, responsible for the day-to-day operation, tuning, and continuous improvement of the enterprise cybersecurity toolset. This role owns advanced detection and response work across endpoint, identity, application, and cloud surfaces; leads investigations of escalated alerts; builds automation that removes manual effort from repeatable security tasks; and translates threat intelligence and vulnerability data into prioritized, actionable remediation for platform and application owners.

Minimum Requirements:

• Combination of education and experience will be considered. Must be authorized to work in the US as defined by the Immigration Act of 1986. Must pass a criminal background check.
• Education: Bachelor's Degree
• Education Details: Bachelor's degree in Computer Science, Software Engineering or related field or equivalent combination of education and experience.
• Certification: Yes
• Certification Details: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Offensive Security Certified Professional (OSCP), or any related industry certifications.
• Years of Experience: Minimum six (6) years of experience in information security. Minimum two (2) years of project or team lead experience.
• Valid/Unexpired Passport Book: Yes Valid/Unexpired Driver's License: Yes
• Master's degree in Computer Science or relevant field.

Preferred Requirements:

• Eight (8) or more years of cybersecurity experience, including time in a security operations center or incident response function.
• Industry certification such as CISSP, GCIH, GCIA, GCFA, GSEC, CySA+, or vendor certification in EDR, SIEM, identity, or cloud security.
• Experience building security automation and orchestration playbooks that integrate multiple tools through APIs.
• Experience operating a threat intelligence program, including managing intelligence feeds, tracking threat actors relevant to the industry, and producing intelligence-driven detections.
• Experience with detection-as-code practices: version control, peer review, and CI/CD pipelines for detection and automation content.
• Experience integrating SAST, DAST, software composition analysis (SCA), and secrets scanning into CI/CD pipelines, including quality gates and build-breaking policy.
• Experience with interactive application security testing (IAST), runtime application self-protection (RASP), API security testing, or bot and fraud mitigation capabilities layered with a WAF.
• Secure code review ability in one or more languages used for web and API development, and familiarity with threat modeling for new features and services.
• Experience with PCI DSS requirements applicable to public-facing web applications, including WAF or equivalent control requirements and application penetration testing obligations.
• Cloud security experience in a major public cloud provider, including native logging and identity services.
• Familiarity with identity threat detection and response concepts, including privileged access management and detection of identity-based attack techniques.
• Experience in a regulated environment subject to requirements such as PCI DSS, SOX, or aviation-sector regulatory oversight.
• Experience supporting operational technology or specialized business systems in addition to corporate IT.
• Experience mentoring analysts, developing runbooks, and leading tabletop or purple team exercises.

Job Duties:

Endpoint Detection and Response

• Operate and tune the enterprise EDR platform; investigate escalated detections, perform host triage and containment, and drive eradication and recovery actions.
• Develop and maintain custom detections, exclusions, and response policies; validate coverage against known attacker techniques.
• Monitor agent health and deployment coverage across the endpoint and server estate and work with platform teams to close gaps.

Automation and Orchestration

• Design, build, test, and maintain automation and orchestration playbooks that reduce manual analyst effort in triage, enrichment, containment, and reporting.
• Integrate security tools through APIs to move context automatically between detection, ticketing, identity, and asset systems.
• Maintain automation content in version control with peer review; measure and report time saved and error reduction.

Security Information and Event Management

• Develop, tune, and maintain correlation rules, use cases, dashboards, and alerts in the SIEM; reduce false positives while preserving detection coverage.
• Onboard new log sources, validate parsing and field normalization, and confirm data completeness and retention against monitoring and compliance requirements.
• Perform threat hunting and historical analysis across aggregated log data to identify activity that automated detections missed.

Threat Intelligence

• Consume, evaluate, and operationalize intelligence from commercial feeds, open sources, industry sharing groups, and government partners; convert relevant intelligence into detections, hunts, and blocking decisions.
• Track threat actors, campaigns, and techniques targeting the aviation, travel, hospitality, and payment sectors and brief stakeholders on relevance and recommended action.
• Produce concise written intelligence summaries for technical teams and leadership.

Vulnerability Management

• Operate scanning and assessment capabilities across endpoints, servers, cloud workloads, containers, and network devices; validate findings and eliminate false positives.
• Prioritize vulnerabilities using severity, exploitability, threat intelligence, asset criticality, and exposure; partner with system owners to define remediation plans and track them to closure.
• Report on remediation performance against defined service levels and escalate aging or high-risk exposures through the established risk process.

Application Security — Static Testing (SAST)

• Operate the static analysis platform: onboard repositories, configure language and framework coverage, tune rulesets, and maintain baselines for legacy code.
• Integrate static scanning into developer workflows and CI/CD pipelines; define and administer quality gates and policy thresholds in partnership with engineering.
• Triage static findings to remove false positives, confirm exploitable issues, and provide developers with specific, code-level remediation guidance and secure coding patterns.
• Support software composition analysis and secrets detection for third-party libraries, open-source dependencies, and credential leakage in source repositories.

Application Security — Dynamic Testing (DAST)

• Plan, schedule, and execute dynamic scans against web applications and APIs across pre-production and production environments, including authenticated scanning and API-definition-driven testing.
• Validate and reproduce dynamic findings, assess real-world exploitability and business impact, and route prioritized results into the remediation and risk-tracking process.
• Support and help scope third-party penetration tests and application assessments, and track resulting findings to closure.

Web Application Firewall

• Operate and tune the web application firewall protecting customer-facing and internal web applications and APIs: managed rule sets, custom rules, rate limiting, geo and reputation controls, and bot mitigation.
• Move new rules through detection only to blocking mode using traffic analysis, minimizing false positives, and avoiding disruption to legitimate customer traffic.
• Monitor and investigate WAF telemetry and blocked-event trends; correlate WAF logs into the SIEM and build detections for application-layer attack patterns, credential stuffing, scraping, and abuse.
• Support onboarding new applications and domains behind the WAF, including policy design, exclusion management, and validation testing with application teams.
• Maintain WAF configuration documentation and evidence supporting applicable regulatory and payment-industry control requirements.

Single Sign-On and Identity Protection

• Support and maintain SSO integrations for enterprise and third-party applications, including federation configuration, application onboarding, and access policy design.
• Configure and tune multifactor authentication, conditional access, and identity risk policies; investigate identity-based alerts such as impossible travel, MFA fatigue, token theft, and privilege escalation.
• Monitor privileged and service accounts, review access anomalies, and support access certification and least-privilege initiatives with the identity and access management team.

Incident Response and General Responsibilities

• Act as an escalation point for security incidents; lead or support investigation, evidence preservation, containment, and post-incident documentation and lessons learned.
• Maintain runbooks, detection documentation, and operational procedures; contribute to tabletop and purple team exercises.
• Mentor junior analysts on investigative techniques, tooling, and quality of documentation.
• Support audit, assessment, and regulatory evidence requests related to security monitoring, vulnerability management