United States — RemoteRole Overview

is seeking a Senior Security Operations Analyst to strengthen enterprise security operations across cloud, identity, endpoint, email, and collaboration environments. You will independently lead complex investigations, improve detection quality, mature SOC processes, and turn operational data into measurable gains in detection, containment, and response.

This role is for an experienced, hands-on SOC practitioner who has owned incidents and operational improvements in a distributed enterprise or SaaS environment. It is not an entry-level, GRC-only, or advisory-only position.

Level & Scope Definition

You will operate as a senior individual contributor with authority to make incident triage, severity, and escalation decisions within ’s response framework. You will own cases from signal through containment, remediation coordination, documentation, and post-incident learning; improve detections, playbooks, dashboards, and procedures; and mentor other analysts. You will influence Security, IT, Cloud, Identity, Engineering, and external providers, while enterprise strategy, company-wide policy, and people management remain outside this role.

Responsibilities

• Lead advanced investigations across endpoint, identity, cloud, email, SaaS, and network telemetry; determine scope, impact, root cause, containment, and follow-up actions.
• Operate and improve an enterprise security stack that includes Sumo Logic Cloud SIEM, Wiz, Rapid7 InsightIDR and InsightVM/Exposure Command, and Darktrace / EMAIL, or comparable platforms.
• Build and tune queries, correlation rules, detections, enrichments, threat hunts, dashboards, case workflows, and SOAR playbooks; improve MITRE ATT&CK coverage and reduce false positives.
• Own the accuracy, reporting, and continuous improvement of SOC measures such as MTTD, MTTC, and MTTR, along with alert fidelity, aged backlog, escalation quality, and SLA attainment.
• Improve SOC runbooks, incident procedures, severity criteria, escalation paths, analyst handoffs, case documentation, and post-incident review practices.
• Partner with system owners to prioritize vulnerability and cloud-risk remediation using business context, exploitability, asset criticality, and compensating controls.
• Use -approved AI capabilities to accelerate log analysis, alert enrichment, case summarization, query development, and playbook drafting while validating outputs and protecting sensitive data.
• Participate in the global on-call rotation and mentor analysts through case reviews, threat scenarios, and practical feedback.

Expected Outcomes

• Reliable SOC metrics with documented, measurable improvement actions.
• Consistent high-severity response, including timely escalation, containment, remediation follow-through, and post-incident learning.
• Stronger detection coverage, alert fidelity, telemetry health, and reusable analyst playbooks.

Must-Have Qualifications

• 5+ years of security experience, including 3+ years in an enterprise SOC, incident response, or detection-and-response function.
• Demonstrated ownership of complex or high-severity investigations from triage through containment and remediation coordination.
• Strong hands-on SIEM experience, including search, correlation, rule tuning, log onboarding, dashboards, and investigation workflows.
• Experience improving SOC processes and using operational metrics to identify bottlenecks and validate improvement.
• Working knowledge across cloud security, EDR, identity, vulnerability management, and email security.
• Clear written and verbal communication with technical and business stakeholders.

Preferred Qualifications

• Direct hands-on experience with two or more of Sumo Logic, Wiz, Rapid7 InsightIDR/InsightVM, and Darktrace / EMAIL.
• Detection engineering, SOAR, threat hunting, PowerShell or Python, multi-cloud monitoring, or MDR coordination experience.
• Responsible use of AI-assisted security or observability workflows with clear validation and data-handling controls.

Ideal Qualifications

• Measurably improved MTTD, MTTC, MTTR, false-positive rates, backlog health, or response SLA performance.
• Led post-incident reviews, established reusable SOC operating practices, or coached other analysts.

Experience Guidelines

Typically 5–9 years of relevant experience, with evidence of enterprise-scale ownership weighted more heavily than tenure alone.

Why work at ?

As part of our commitment to your well-being, we are pleased to offer comprehensive benefits packages to employees across the US. Benefits packages generally include:

• Best in class employee onboarding and training
• "Take What You Need” paid time off policy
• Comprehensive health, dental and vision plans
• Company-paid life and disability insurance
• 401(k) and Roth IRA retirement plan
• Generous employee referral bonuses
• Flexible remote work policy
• 10 Paid Holidays
• Wide array of wellbeing offerings
• Pre-tax savings accounts with company contributions
• Great team culture and social activities
• Collaborative workspaces
• Free on-site fitness centers and stocked kitchens in select office locations
• Professional development resources

Compensation Transparency:

In accordance with U.S. pay transparency laws, is committed to providing visibility into compensation for all U.S.-based roles. Click HERE to view our compensation ranges by job grade. Actual compensation will be based on a variety of factors, including a candidate’s experience, skills, education, and work location.

To all recruitment agencies: does not accept agency resumes. Please do not forward resumes to our job boards, employees or any other company location. is not responsible for any fees related to unsolicited resumes.

is an equal opportunity employer. The equal employment opportunity policy at protects employees and job applicants from discrimination on the bases of race, religion, color, sex (including pregnancy, gender identity, and sexual orientation), parental status, national origin, age, disability, family medical history or genetic information, political affiliation, military service, or other non-merit based factors. These protections extend to all management practices and decisions, including recruitment and hiring practices, appraisal systems, promotions, and training and career development programs.