Cybersecurity Analyst

Trupanion

. Monitor and triage alerts across identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies .

Posted 11/3/2026full-timeRemote • United StatesMid-LevelSenior💰 $120,000 - $140,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity operations, incident response, and threat intelligence analysis, with a strong focus on vulnerability management and remediation workflows. Proficient in utilizing security automation tools and methodologies to enhance incident detection and response capabilities.

Highest-signal resume keywords

Cybersecurity OperationsIncident ResponseThreat Intelligence AnalysisVulnerability ManagementSecurity Automation

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SIEMEDR/XDRThreat HuntingVulnerability ValidationIncident TelemetryDigital Evidence HandlingPhishing InvestigationMalware AnalysisPrivilege Escalation InvestigationData Exposure Assessment

Soft Skills

Analytical ThinkingAttention to DetailProblem SolvingCommunicationCollaboration

Tools & Technologies

Microsoft DefenderMicrosoft SentinelMicrosoft 365AzureIdentity SecurityEndpoint SecurityVulnerability Scanning PlatformsThreat Intelligence PlatformsAutomation WorkflowsIncident Management Systems

Certifications & Qualifications

Security+CySA+SC-200GCIHGCIA

Industry Keywords

NIST CSFISO 27001PCI DSSNYDFS Cybersecurity RequirementsDigital ForensicsIncident TelemetryThreat-Led EscalationChain-of-Custody ProceduresLegal-Hold ProceduresData Protection

Tech Stack

Tools & technologies

AzureCloudCyber Security

About the role

Key responsibilities & impact

Monitor and triage alerts across identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies
Validate, enrich, classify, prioritize, and investigate security events including phishing, account compromise, malware, ransomware, unauthorized access, data exposure, insider threat, and third-party events
Execute approved containment actions and coordinate infrastructure-level or production changes with Technology Operations
Collect and preserve evidence; identify affected users, devices, accounts, systems, repositories, and data
Support eradication, recovery validation, heightened monitoring, and incident closure
Collect and evaluate commercial, government, industry, open-source, MDR, vendor, and internal threat intelligence
Analyze threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies
Create tactical and operational intelligence products and operationalize findings through investigations, detections, hunting queries, watchlists, blocking actions, phishing simulations, and runbook updates
Conduct hypothesis-driven threat hunts using MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions
Validate vulnerability findings, assess risk and business exposure, prioritize remediation, identify exploitation, and escalate urgent vulnerabilities
Partner with Security Engineering on vulnerability-scanning platforms, integrations, configuration, and reliability
Coordinate remediation assignments, maintain vulnerability ticket flow, track service levels, report overdue exposure, and escalate ownership or delivery issues
Develop and maintain approved automation workflows, scripts, and playbooks
Preserve evidence under approved forensic, legal-hold, integrity, and chain-of-custody procedures
Maintain complete security case records and validate containment and corrective actions
Support breach investigations and identify affected repositories, records, data types, individuals, entities, and jurisdictions for Legal and Privacy review
Investigate token theft, MFA changes, privilege escalation, malicious application consent, mailbox manipulation, and compromised identities
Investigate third-party, supply-chain, and AI-related security notifications or suspected misuse
Execute alert triage, investigations, MDR monitoring, threat intelligence analysis, threat hunting, vulnerability validation, remediation follow-up, metrics, reporting, case documentation, and authorized security-tool actions
Escalate architecture, complex integration, detection-platform design, routine vulnerability administration, and permanent engineering needs to Security Engineering
Provide structured handovers across operating regions and technical evidence to Legal and Privacy

Requirements

What you’ll need

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or a related field, or equivalent practical experience
3+ years of experience in cybersecurity operations, incident response, IT operations, system administration, network security, or a related area
Experience investigating alerts using SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability technologies
Knowledge of common attacker techniques, phishing, malware, account compromise, privilege misuse, lateral movement, exfiltration, and vulnerability exploitation
Demonstrated experience applying threat intelligence and incident telemetry to vulnerability prioritization and exploitation assessment
Experience with security automation or scripting, digital-evidence handling, identity investigations, third-party incident analysis, and structured case management
Experience with Microsoft Defender, Microsoft Sentinel, Microsoft 365, Azure, identity security, privileged access management, cloud security, and endpoint environments
Familiarity with MITRE ATT&CK and common detection, threat-hunting, and incident-response methodologies
Understanding of vulnerability scanning and remediation workflows and the division of responsibility between vulnerability-program governance, threat-led escalation, and asset-owner remediation
Knowledge of NIST CSF, ISO 27001, PCI DSS, NYDFS cybersecurity requirements, or privacy and breach-response obligations
Ability to support defined US business-hour coverage and participate in an escalation or on-call rotation
Availability to assist with high-severity incidents outside normal working hours when required
Ability to handle confidential, legally sensitive, and security-restricted information appropriately
Applicants must be authorized to work for any employer in the U.S.; employment-visa sponsorship is unavailable
Security+, CySA+, SC-200, GCIH, GCIA, or equivalent experience preferred

Benefits

Comp & perks

Monthly bonuses
Restricted Stock Units for all new team members, vesting over 4 years
Full medical, dental, and vision benefits at no cost to the employee
Four weeks of paid time off
9 paid float holidays
Five-week sabbatical after five years of employment
Open, casual, pet-friendly, and fun office environment
Free medical health insurance for one dog or cat
Paid time off to volunteer at nonprofit organizations
Free on-site gym
Free dog walking services for office pets during business hours
Free parking
Paid ORCA cards