Senior Security Operations Analyst

• You will operate as a senior individual contributor with authority to make incident triage, severity, and escalation decisions within Nasuni’s response framework. You will own cases from signal through containment, remediation coordination, documentation, and post-incident learning; improve detections, playbooks, dashboards, and procedures; and mentor other analysts
• You will influence Security, IT, Cloud, Identity, Engineering, and external providers, while enterprise strategy, company-wide policy, and people management remain outside this role
• Lead advanced investigations across endpoint, identity, cloud, email, SaaS, and network telemetry; determine scope, impact, root cause, containment, and follow-up actions
• Operate and improve an enterprise security stack that includes Sumo Logic Cloud SIEM, Wiz, Rapid7 InsightIDR and InsightVM/Exposure Command, and Darktrace / EMAIL, or comparable platforms
• Build and tune queries, correlation rules, detections, enrichments, threat hunts, dashboards, case workflows, and SOAR playbooks; improve MITRE ATT&CK coverage and reduce false positives
• Own the accuracy, reporting, and continuous improvement of SOC measures such as MTTD, MTTC, and MTTR, along with alert fidelity, aged backlog, escalation quality, and SLA attainment
• Improve SOC runbooks, incident procedures, severity criteria, escalation paths, analyst handoffs, case documentation, and post-incident review practices
• Partner with system owners to prioritize vulnerability and cloud-risk remediation using business context, exploitability, asset criticality, and compensating controls
• Use Nasuni-approved AI capabilities to accelerate log analysis, alert enrichment, case summarization, query development, and playbook drafting while validating outputs and protecting sensitive data
• Participate in the global on-call rotation and mentor analysts through case reviews, threat scenarios, and practical feedback
• Expected Outcomes:
• Reliable SOC metrics with documented, measurable improvement actions
• Consistent high-severity response, including timely escalation, containment, remediation follow-through, and post-incident learning
• Stronger detection coverage, alert fidelity, telemetry health, and reusable analyst playbooks

Benefits

• Generous paid time off
• Comprehensive medical, dental, and vision plans
• Retirement/pension plans
• Professional growth opportunities and performance bonuses
• Work/life balance with flexible schedules and locations
• Generous employee referral bonus
• Incentive stock options
• Free on-site fitness center
• Work from home
• Flexible commuting options including bike, water shuttle, and public transportation
• Complimentary on-site snacks and beverages
• Stand-up desks
• Pre-tax commuter benefits in many states
• Pet insurance

• Strong hands-on SIEM experience, including search, correlation, rule tuning, log onboarding, dashboards, and investigation workflows
• Demonstrated ownership of complex or high-severity investigations from triage through containment and remediation coordination
• Clear written and verbal communication with technical and business stakeholders
• Experience improving SOC processes and using operational metrics to identify bottlenecks and validate improvement
• Working knowledge across cloud security, EDR, identity, vulnerability management, and email security
• 5+ years of security experience, including 3+ years in an enterprise SOC, incident response, or detection-and-response function
• Typically 5–9 years of relevant experience, with evidence of enterprise-scale ownership weighted more heavily than tenure alone
• Responsible use of AI-assisted security or observability workflows with clear validation and data-handling controls
• Detection engineering, SOAR, threat hunting, PowerShell or Python, multi-cloud monitoring, or MDR coordination experience
• Direct hands-on experience with two or more of Sumo Logic, Wiz, Rapid7 InsightIDR/InsightVM, and Darktrace / EMAIL
• Measurably improved MTTD, MTTC, MTTR, false-positive rates, backlog health, or response SLA performance
• Led post-incident reviews, established reusable SOC operating practices, or coached other analysts