Expert IT Cyber Defense Analyst

An Ideal Candidate will have: Perform continuous monitoring of network, endpoint, identity, cloud, and application telemetry using SIEM, EDR, IDS/IPS, Firewall, AAD, and vulnerability management platforms. Identify sophisticated threats by correlating multi-source telemetry, detecting anomalies, and recognizing attacker TTPs. Enhance SIEM and EDR detection logic by creating and tuning correlation rules, behavioral analytics, watchlists, and automated alert workflows to reduce false positives and improve detection fidelity. Lead high-severity incidents and complex investigations involving malware, privilege misuse, lateral movement, ransomware indicators, persistence mechanisms, and potential data exfiltration. Conduct in-depth forensic analysis of endpoints, logs, cloud audit trails, and network flows to determine root cause, scope, and business impact. Collaborate with the Incident Response (IR) team to drive containment, eradication, and recovery efforts with minimal operational disruption. Perform proactive threat hunting aligned with the latest threat intelligence, emerging TTPs, vulnerabilities, and adversary campaigns. Serve as a subject matter expert for Tier 1 and Tier 2 analysts, providing guidance on triage decisions, investigation handling, and escalation criteria. Review and audit alerts handled by junior analysts to ensure accuracy, completeness, and adherence to SOC processes. Contribute to SOC capability uplift through training, knowledge sharing, and continuous improvement initiatives. Develop, refine, and maintain SOPs, incident response playbooks, and detection runbooks to support consistent and repeatable operations. Assess business impact of ongoing or emerging threats and help prioritize response efforts based on severity and risk. Communicate technical findings, risks, and remediation recommendations to technical and non-technical stakeholders. Collaborate with Cloud, Infrastructure, Application, and Threat Intelligence teams to resolve vulnerabilities and operationalize intelligence-driven detections. The ideal candidate will have: Bachelor s degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical experience. 5 8+ years of experience in SOC operations, cyber defense, threat hunting, or incident response roles. Strong hands-on expertise with SIEM (Splunk, Sentinel), EDR (CrowdStrike, Microsoft Defender), IDS/IPS, Firewalls, and cloud security monitoring (Azure/AWS). Deep knowledge of Windows, Linux, and cloud audit logs, authentication flows, and security telemetry. Proven experience investigating high-severity incidents, malware behavior, lateral movement, privilege misuse, and network-based threats. Strong understanding of MITRE ATTCK, cyber kill chain, threat intelligence lifecycle, and adversary detection techniques. Experience writing detection rules, triage workflows, and automated SOAR playbooks. Strong analytical, investigative, and communication skills. Preferred Certifications GCIH (GIAC Certified Incident Handler) Security+ CEH CySA+ AZ-500