Security Analyst II, CrowdStrike Next-Gen SIEM

We Help the World Be Everyday ReadyTM

Responsibilities:

• Serve as a dedicated Security Analyst supporting the client's security operations and acting as an extension of the client's security team.
• Perform security event triage, investigation, and response activities utilizing alerts and findings generated by the MDR service providers.
• Act as the primary point of contact for all security incidents and coordinate response efforts across internal and external stakeholders.
• Review, validate, and take appropriate response actions based on incidents escalated to client.
• Conduct deep-dive investigations across endpoint, network, email, cloud, and identity platforms to determine the scope and impact of security incidents.
• Manage incident communications, documentation, and status updates throughout the incident lifecycle.
• Coordinate containment, eradication, and recovery activities with client IT and security teams.
• Work closely with Firewall Management teams to implement and validate security controls required during incident response activities.
• Coordinate with Email Security teams to investigate phishing threats, malicious email campaigns, and email-based compromises.
• Perform proactive threat hunting activities and identify indicators of compromise across the client's environment.
• Map observed threats and client use cases to the MITRE ATT&CK framework and provide recommendations to enhance security posture.
• Collaborate security service providers to ensure investigation and resolution of security events.
• Maintain detailed incident records, lessons learned, and recommendations for improving detection and response capabilities.
• Develop trusted relationships with client stakeholders and provide security guidance aligned with business objectives.
• Stay current with emerging threats, attack techniques, and industry best practices.

Requirements:

• 3+ years of experience in Security Operations Center (SOC), Incident Response, Threat Hunting, or Cybersecurity Operations roles.
• Experience working directly within client environments or as a dedicated security resource supporting enterprise customers.
• Strong understanding of Incident Response processes and lifecycle management.
• Experience working with SIEM solutions, preferably CrowdStrike Next Gen SIEM for log analysis, correlation, and investigation.
• Experience working with Endpoint Detection and Response (EDR) solutions, preferably CrowdStrike EDR.
• Experience collaborating with Managed Detection and Response (MDR) providers and managing escalations from external security service providers.
• Strong understanding of CrowdStrike Falcon platform and security operations workflows.
• Experience investigating phishing, malware, ransomware, account compromise, and insider threat incidents.
• Familiarity with email security platforms such as Proofpoint and common email threat vectors.
• Understanding of firewall technologies, such as PaloAlto, network security controls, and change management processes related to incident response.
• Strong knowledge of the MITRE ATT&CK framework and adversary tactics, techniques, and procedures (TTPs).
• Coordinate with multiple teams and drive incident response activities to completion.
• Strong customer-facing and stakeholder management experience.
• Think from a client ownership perspective rather than a service provider perspective, taking accountability for security outcomes and business risk.
• Relevant certifications such as Security+, CEH, SC-200, GCIH, GCFA, or equivalent security certifications.
• Basic scripting or automation experience (PowerShell, Python, KQL, SPL).

Additional information