Senior Cybersecurity Analyst

Job description

Job responsibilities

• Lead complex cybersecurity investigations from initial triage through containment, eradication, recovery, and closure, ensuring timely execution and thorough documentation.
• Serve as the primary technical lead for escalated security incidents, establishing investigation priorities, assigning tasks, and coordinating response activities across analysts and technical teams.
• Analyze endpoint, identity, email, network, and cloud telemetry to determine incident scope, attack vectors, affected assets, adversary activity, and potential business impact.
• Develop incident timelines and identify root causes, persistence mechanisms, lateral movement, and indicators of compromise.
• Collect, preserve, and analyze digital evidence in accordance with established evidence-handling, chain-of-custody, and retention procedures.
• Coordinate containment and remediation with IT, engineering, application owners, and business stakeholders, balancing incident urgency with operational requirements.
• Investigate phishing, account compromise, malware, ransomware, unauthorized access, data exfiltration, and suspected insider threats within approved investigative authority.
• Use Microsoft Sentinel, Microsoft Defender, and other security platforms to correlate alerts, develop investigative queries, and validate findings.

Job requirements

• 5+ years of experience in cybersecurity incident response, security operations, digital forensics, or related discipline.
• Demonstrated experience leading the investigation and response of complex security incidents, including: Ransomware and malware, Phishing and business email compromise, Account compromise and credential theft, Insider…
• Strong knowledge of incident response processes, including preparation, detection, analysis, containment, eradication, recovery, and lessons learned.
• Experience using security technologies such as: SIEM platforms, Endpoint Detection and Response (EDR) tools, Network monitoring and intrusion detection systems, Vulnerability management platforms, Digital forensic and…
• Proficiency analyzing all Operating System logs, authentication logs, network traffic, endpoint telemetry, and cloud security events.
• Knowledge of common attack techniques and frameworks, including MITRE ATT&CK, the Cyber Kill Chain, and the NIST Incident Response Framework.
• Experience with scripting or automation using tools such as PowerShell, Python, Bash, or similar.
• Ability to write clear incident reports, technical findings, executive summaries, and after-action reports.