Senior Cyber Defense Analyst

5-7 years hands-on SOC or Incident Response experience. Strong understanding of attacker lifecycle, MITRE ATT&CK, and threat actor TTPs. Experience with EDR (CrowdStrike preferred), SIEM (Splunk preferred), and SOAR (Torq, XSOAR, or Phantom). Familiarity with AWS, Okta, and SaaS platforms. Proficiency in writing queries and automations using Python, SPL, or equivalent. Excellent analytical and investigative skills. Strong documentation and communication skills.

Monitor and triage security alerts from SIEM, EDR, IAM, CSPM, CDR. Lead incident containment, eradication, and recovery. Perform root cause analysis and propose preventive controls. Proactively hunt for threats using MITRE ATT&CK framework. Build or enhance playbooks in SOAR. Create custom enrichment scripts and automations. Track and report operational metrics. Maintain documentation and lessons learned.