Senior Security Analyst – Security Operations Center (SOC)

Lennar

. Lead investigations of complex, high-severity security incidents through containment, remediation, and recovery .

Posted 10/9/2026full-timeUnited StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading incident response efforts, including triage, investigation, and remediation of security incidents. Proficient in developing and operationalizing detection content, automation workflows, and maintaining security posture across various platforms.

Highest-signal resume keywords

Incident Response LeadershipSIEM/SOAR Platform ExpertiseDetection Content AuthoringCloud Security Telemetry AnalysisAutomation and Scripting Skills

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseRoot Cause AnalysisThreat HuntingDetection Logic DevelopmentMalware AnalysisKQLCloud SecurityNetwork Security ConceptsAutomation WorkflowsPerformance Metrics Measurement

Soft Skills

Analytical SkillsProblem-SolvingCommunication SkillsAbility to Work Under PressureKnowledge Sharing

Tools & Technologies

Microsoft SentinelMicrosoft Defender XDRPalo Alto Cortex XDRServiceNowSOAR PlatformsSIEMThreat Intelligence PlatformsAzureAWSMITRE ATT&CK

Certifications & Qualifications

CompTIA Security+CISSPGCIAGCIHGCFACySA+EJPT/PJPTCEHSC-200

Industry Keywords

Cybersecurity OperationsSOCIncident TriageRemediationThreat Actor TacticsComplianceAuditTelemetryAutomationPerformance Metrics

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityPythonServiceNow

About the role

Key responsibilities & impact

Lead investigations of complex, high-severity security incidents through containment, remediation, and recovery
Coordinate incident response across internal teams and the MDR partner
Act as the primary escalation point for Tier 3 alerts and incidents
Perform root cause analysis and create actionable remediation plans
Liaise with the MDR provider to validate and triage alerts, align response protocols, and improve detection fidelity
Develop and maintain incident response playbooks, runbooks, and workflows
Analyze threat actor tactics, techniques, and procedures and improve defenses and detection content
Conduct proactive threat hunts across endpoint, identity, network, and cloud telemetry using threat intelligence and MITRE ATT&CK
Operationalize hunt findings into detection logic and response procedures
Design automation for recurring or manual SOC processes
Build, test, and maintain SOAR playbooks and automated response workflows
Develop, tune, and operationalize detection and correlation rules
Measure automation impact using MTTD, MTTR, alert volume, and false-positive rate
Partner with Detection Engineering and Security Engineering to integrate tooling and close telemetry gaps
Monitor and analyze logs and alerts across SIEM, EDR, identity, and cloud platforms
Correlate data across multiple sources to identify patterns, anomalies, and emerging threats
Maintain awareness of the external threat landscape and internal security posture
Mentor Tier 1 and Tier 2 analysts and lead knowledge-sharing
Document incident timelines, findings, and lessons learned
Track and improve SOC performance metrics and prioritize tuning and automation
Generate executive-level and technical SOC performance and incident reports
Support compliance and audit efforts through record-keeping and evidence handling

Requirements

What you’ll need

Minimum 5-7 years of experience in a cybersecurity operations role, with at least 3 years in a Tier 2/Tier 3 SOC or escalation capacity
CompTIA Security+ or equivalent
Proven experience leading incident response triage, investigation, and remediation, including working directly with MDR partners
In-depth knowledge of SIEM/SOAR platforms, including Microsoft Sentinel
Experience with endpoint detection and response solutions, including Microsoft Defender XDR and Palo Alto Cortex XDR
Experience with ticketing systems such as ServiceNow
Ability to author and tune detection content, including KQL in Sentinel/Defender, and operationalize it into production
Experience analyzing cloud security telemetry, including Azure/Entra sign-in logs and AWS CloudTrail
Hands-on experience building or maintaining automated playbooks and response workflows in a SOAR platform
Strong understanding of network security concepts, operating systems, and malware analysis techniques
Familiarity with the MITRE ATT&CK framework and threat intelligence platforms
Excellent analytical, problem-solving, and communication skills; ability to work under pressure and manage multiple priorities
On-call rotation may be required for critical incident response
Preferred: certifications such as CISSP, GCIA, GCIH, GCFA, CySA+, eJPT/PJPT, CEH, SC-200
Preferred: scripting and automation skills in Python and PowerShell
Preferred: experience supporting an EDR platform migration
Preferred: experience with or strong interest in AI-assisted triage and agentic SOC tooling
Preferred: broader cloud security experience across AWS, Azure, and OCI
Preferred: experience with Microsoft Sentinel, Proofpoint, and Palo Alto Cortex XDR

Benefits

Comp & perks

Medical, Dental, and Vision health insurance coverage
401(k) Retirement Plan with a $1 for $1 Company Match up to 5%
Paid Parental Leave
Associate Assistance Plan
Education Assistance Program
Up to $30,000 in Adoption Assistance
Up to three weeks of vacation annually from the moment of hire
Holiday, Sick Leave, and Personal Day policies
New Hire Referral Bonus Program
Home Purchase Discounts
Everyone’s Included Day
Collaborative team environment with opportunities for growth and specialization