Senior Security Analyst

Lead

. Build, tune, and maintain SIEM detection rules and alerts, writing queries aligned to MITRE ATT&CK .

Posted 10/28/2026full-timeNew York City • New York • United StatesSenior💰 $142,875 - $170,910 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in incident response, SIEM detection rule development, and cloud security, particularly within AWS environments. Proficient in log management, vulnerability triage, and security audits, with strong communication skills to mentor junior analysts and collaborate with engineering teams.

Highest-signal resume keywords

SIEM Detection Rule DevelopmentIncident Response ExecutionCloud Security (AWS, GCP, Azure)Log Management and AnalysisVulnerability Triage and Remediation

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Query WritingDetection EngineeringLog ParsingScripting (Python, Bash)CI/CD SecurityInfrastructure as Code (Terraform, CloudFormation)Forensic Log AnalysisNetwork Security ToolsData NormalizationExposure Management

Soft Skills

Strong Written CommunicationStrong Verbal CommunicationMentoring

Tools & Technologies

Enterprise EDR/XDR PlatformsSOARIdentity Protection ToolsGitHub

Certifications & Qualifications

CISSPGCIHGCIAGCEDCEHGDSA

Industry Keywords

NIST CSFGLBAFFIECRegulated IndustryFinancial ServicesHealthcare

Tech Stack

Tools & technologies

AWSAzureCloudETLGoogle Cloud PlatformLinuxMacOSPythonTerraform

About the role

Key responsibilities & impact

Build, tune, and maintain SIEM detection rules and alerts, writing queries aligned to MITRE ATT&CK
Own incident response execution end-to-end, including containment, eradication, recovery, lessons learned, forensic log analysis, and post-incident reporting
Monitor and investigate security events across endpoints, AWS cloud, identity, and network telemetry
Identify misconfigurations, anomalous activity, and suspicious behavior
Assist with security audits and regulatory examinations by providing accurate security documentation and evidence
Analyze systems, applications, and networks for security configurations in partnership with security engineers
Manage log pipelines, including ingestion, parsing, normalization, and enrichment
Triage and prioritize vulnerability findings using risk-based frameworks and track remediation SLAs with IT and Engineering
Collaborate with Engineering on IaC and CI/CD security reviews
Contribute to runbooks and playbooks
Mentor junior analysts
Partner with leadership to advance the organization's security posture
Perform all other duties as assigned

Requirements

What you’ll need

5+ years in information security or security operations
Hands-on SIEM experience with query writing, detection building, and alert tuning
Strong working knowledge of cloud security concepts and services; AWS preferred, with GCP and Azure also considered
Proficiency working with logs across endpoint, cloud, network, identity, and application sources
Understanding of CI/CD pipelines and IaC, including Terraform and CloudFormation, from a security perspective
Solid grasp of Windows, macOS, and Linux internals, including processes, persistence mechanisms, and attacker TTPs
Demonstrated incident response experience, including leading or contributing to investigations
Familiarity with data normalization, log parsing, and ETL concepts
Strong written and verbal communication skills
Experience with log routing, transformation, and enrichment
Hands-on experience with enterprise EDR/XDR platforms and ecosystem tooling, including SOAR, exposure management, and identity protection
Experience with network security tools and interpreting proxy or web traffic logs
Background in a regulated industry, such as financial services or healthcare, with familiarity with NIST CSF, GLBA, or FFIEC
Scripting or automation experience with Python or Bash, detection engineering, workflow automation, and version-controlled code in GitHub
Relevant certifications such as CISSP, GCIH, GCIA, GCED, CEH, or GDSA, or equivalent are preferred
Detection as Code experience using version-controlled detection content is nice to have
Exposure to identity security tooling is nice to have

Benefits

Comp & perks

Medical, Dental, Vision, Life insurance
401k matching
Wellness benefits, including FSA, HSA and HRA
Paid parental leave
Flexible vacation policy, including PTO and paid holidays
Opportunities for career growth
Fun and challenging team environment in a dynamic industry