Analyst - Security Operations

Analyst - Security Operations 7/31/26

The opportunity

We are looking for Incident Analyst to anchor the technical depth of our 24×7 Security Operations Center. This role detects, triages, investigates and responds to security incidents across our private-cloud platform and the enterprise services it supports. The successful candidate is a hands-on practitioner who can own an incident end to end — from the first alert in Splunk through containment, eradication and recovery — while also raising the quality of our detections and acting as a senior escalation point and mentor for less-experienced analysts. The environment is a private cloud built on OpenStack and Red Hat OpenShift, instrumented with Splunk (SIEM), Cribl (data pipeline), Elastic Security (EDR) and Corelight (NDR); comfort working across virtualized and containerized infrastructure log sources is expected.

Your Key Responsibilities

Security Monitoring, Triage & Detection

• Monitor security alerts and events in Splunk to identify threats, anomalies and malicious activity across the private-cloud platform and enterprise services
• Perform triage and investigation of security events, acting as the senior technical decision point on whether an alert represents a genuine incident
• Investigate EDR and NDR alerts involving malware, suspicious scripts, credential theft, lateral movement, persistence, ransomware and endpoint or network compromise
  
  

• Own security incidents end to end across the full response lifecycle: identification, containment, eradication, recovery and post-incident review
• Execute containment and remediation actions in coordination with platform, infrastructure, network and application teams
• Lead the response on assigned incidents and coordinate cross-team activity to ensure timely investigation, escalation and resolution
• Develop and maintain incident response playbooks and standard operating procedures (SOPs), and drive their improvement after each major incident
  
  

• Create, tune and optimize Splunk correlation searches, alerts, dashboards and reports to improve detection quality and coverage
• Write and maintain efficient SPL queries supporting investigation, hunting, reporting and detection engineering
• Reduce alert fatigue by tuning noisy detections, lowering false positives and strengthening correlation logic, weighing false-positive cost against miss cost when making tuning decisions
• Support onboarding of new log sources and validate log quality, parsing, field extraction and normalization
• Manage and maintain Cribl Stream/Edge pipelines for log routing, filtering, enrichment and normalization, optimizing data flow and Splunk license consumption
  
  

• Conduct hypothesis-driven threat hunts to uncover advanced persistent threats (APTs) and techniques that evade existing detections
• Map detection coverage to MITRE ATT&CK, identify and report gaps, and convert successful hunts into durable detections
• Apply threat intelligence and frameworks (MITRE ATT&CK, Cyber Kill Chain, Diamond Model) to enrich investigations and improve detection and response
• Identify patterns, trends and indicators of compromise (IOCs) to proactively detect and prevent recurrence
  
  

• Conduct root cause analysis (RCA) and produce clear incident reports for management and stakeholders
• Maintain accurate, detailed records of incidents, actions taken, evidence collected and lessons learned in the case-management platform
• Contribute to the continuous improvement of security monitoring use cases and detection rules
• Support audit and compliance requirements by providing evidence of incident-management activities
  
  

• Full-time role reporting to the SOC Manager, operating within a 24×7 Security Operations Center
• Participation in rotational shifts — day, evening and night — including weekends and public holidays on a rotational basis
• Defined acknowledgement, triage and escalation SLAs apply to each shift, with structured shift handovers to maintain continuity of in-flight incidents
  
  

• Required skills / qualifications
  
  

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity or a related field; equivalent professional experience and certifications will be considered in lieu of a degree
  
  

• 4–8 years in security operations, incident response or SOC monitoring
• Proven hands-on experience with Splunk — advanced SPL, dashboard development, alert creation, correlation and administration
• Demonstrated experience with Cribl Stream/Edge — data routing, filtering, pipelines and log enrichment
• Strong background in incident analysis, investigation, evidence handling, escalation management and full-lifecycle response aligned with industry standards
  
  

• SIEM: Splunk Enterprise / Splunk Cloud — advanced SPL, dashboard development, correlation searches, alert tuning, administration
• Data Pipeline: Cribl Stream / Cribl Edge — log routing, parsing, filtering, enrichment and pipeline management
• EDR / NDR: Elastic Security (EDR) and Corelight (NDR) for endpoint and network threat detection, investigation and response
• Incident Response: end-to-end IR lifecycle, playbook and SOP development, RCA, evidence collection and handling
• Threat Frameworks: MITRE ATT&CK (including coverage mapping), Cyber Kill Chain, Diamond Model
• Networking: strong understanding of TCP/IP, DNS, HTTP/S, firewalls, proxies and IDS/IPS
• Operating Systems: proficiency in Windows and Linux environments
• Scripting: proficiency in Python, Bash or PowerShell for automation and analysis
• Platform Technologies: familiarity with private-cloud and platform log sources — Red Hat OpenShift, OpenStack, Commvault, Scality and related infrastructure
• Ticketing / Case Mgmt: ServiceNow, Jira or equivalent for incident tracking, evidence attachment, escalation notes and closure documentation
• Preferred skills / qualifications
  
  

• Splunk Core Certified Power User or Splunk Certified Admin
• Cribl Certified Admin
• GIAC certifications relevant to detection and response — GCIA, GCIH, GCDA or GCFA
• Blue Team Level 2 (BTL2) or equivalent hands-on defensive certification
• Experience monitoring OpenStack and Kubernetes/OpenShift environments
• Familiarity with detection-as-code practices (version control and peer review of detection content)