threat hunter

NaurEmerald ITServices

About the role Entry-level SOC analyst role responsible for 24/7 monitoring, initial triage, and escalation of security alerts using modern detection and response tools.Key responsibilities<ul><li>Monitor alerts from SIEM, EDR, IDS/IPS, firewalls, cloud security tools, and other telemetry.</li><li>Triage and enrich security events: validate alerts, assess severity, and gather contextual data.</li><li>Escalate confirmed incidents to Tier 2 / Incident Response with evidence and recommended actions.</li><li>Execute playbooks and runbooks for common detections (malware, suspicious logins, lateral movement, data exfiltration).</li><li>Investigate logs, network flows, endpoint telemetry, and cloud activity to determine scope and impact.</li><li>Perform basic forensic collection and preserve artifacts per procedures.</li><li>Maintain accurate incident records in the ticketing/incident management system.</li><li>Ingest and apply threat intelligence: map IOCs, update watchlists, and tune detections.</li><li>Collaborate with IT Ops, Platform, and DevOps teams to remediate vulnerabilities and misconfigurations.</li><li>Participate in shift rotations for 24/7 SOC coverage and produce handover briefings.</li><li>Contribute to continuous improvement: refine playbooks, reduce false positives, and document lessons learned.</li><li>Adhere to security policies, compliance requirements, and data handling procedures.</li></ul>Qualifications<ul><li>Bachelor&rsquo;s degree in Cybersecurity, Computer Science, IT, or equivalent; or relevant certifications/experience.</li><li>0&ndash;2 years in security monitoring, IT support, or network/endpoint administration.</li><li>Familiarity with SIEM (Splunk, Microsoft Sentinel, Elastic, or similar) and EDR (CrowdStrike, SentinelOne, Carbon Black, etc.).</li><li>Basic understanding of network protocols (TCP/IP, DNS, HTTP/S), host OS internals (Windows/Linux), and log analysis.</li><li>Knowledge of security concepts: authentication, IAM, encryption, malware types, and attack techniques (MITRE ATT&amp;CK desirable).</li><li>Comfortable with command-line tools, basic scripting (Python, PowerShell, or Bash), and query languages (KQL, SPL, Elastic DSL).</li><li>Strong analytical skills, attention to detail, and ability to work under pressure.</li><li>Good communication skills in English; Arabic is a plus.</li><li>Willingness to work shifts (including nights) and participate in on-call rotations.</li></ul>Preferred (not required)<ul><li>Certifications: CompTIA Security+, CySA+, CEH, or SOC-specific credentials.</li><li>Experience with cloud security monitoring (AWS/Azure/GCP) and cloud-native logging.</li><li>Familiarity with SOAR platforms (Cortex XSOAR, Splunk SOAR) and threat intelligence tools.</li><li>Prior exposure to incident response, malware analysis, or digital forensics.</li></ul>What we offer<ul><li>Competitive Oman-market salary and benefits.</li><li>Training, mentorship, and certification support.</li><li>Career progression to Tier 2/Incident Responder, Threat Hunter, or SOC Engineer roles.</li><li>Modern tools and a collaborative SOC environment with hybrid work options.</li></ul>Job Type: Full-timePay: RO19.000 - RO30.000 per hourExpected hours: 40 per weekWork Location: On the road

Cybersecurity Analyst (Tier 1 / SOC Analyst)

CrowdStrike

<div>As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn&rsquo;t changed &mdash; we&rsquo;re here to stop breaches, and we&rsquo;ve redefined modern security with the world&rsquo;s most advanced AI-native platform. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We&rsquo;re also a mission-driven company. We cultivate a culture that gives every CrowdStriker both the flexibility and autonomy to own their careers. We&rsquo;re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you.
About the Role:
CrowdStrike is looking for a highly motivated, self-driven, cloud threat hunter dedicated to making a difference in global security by protecting organizations against the most advanced adversaries in the world. Our CrowdStrike Professional Services team offers opportunities to expand your skill set through a wide variety of impactful consulting engagements for many of the world's leading organizations.
The Cloud Threat Hunting Principal Consultant will be responsible for conducting compromise assessments in cloud environments to identify active and historical threats, reviewing cloud control plane configurations, and providing actionable recommendations to enhance the security posture of customer cloud environments.
What You&rsquo;ll Do:<ul><li>
Drive hunting methodology improvements, including maturing existing capabilities, developing new service features, and cross-functional collaboration with product, IR, and data science.</li><li>
Develop queries, scripts, AI prompts, and dashboards to automate the hunting for and analysis of deterministic behaviors and IOAs.</li><li>
Build agentic workflows using orchestration frameworks to augment and automate data analysis and reporting tasks.</li><li>
Leverage analytics and threat intelligence to analyze cloud logs and control plane configurations to identify historical and active threats.</li><li>
Manage complex client complex engagements, lead internal teams, and provide regular status updates to clients regarding project status and findings.</li><li>
Produce high-quality written and verbal reports, presentations, recommendations, and findings to key stakeholders including customer management, regulators, and legal counsel.</li><li>
Demonstrate industry thought leadership through blog posts, CrowdCasts, and other public speaking events.</li></ul>
What You&rsquo;ll Need:
Successful candidates will have experience in one or more of the following areas:<ul><li>
A strong understanding of one or more of the following cloud platforms: AWS, Azure, or GCP, including identity, architecture, security, and logging.</li><li>
An understanding of Agentic AI and at least one orchestration framework.</li><li>
Strong analytical skills, attention to details, and ability to work with large data sets up to terabytes in size.</li><li>
At least 5 years of hands-on threat hunting experience in cloud and/or on-premises environments.</li><li>
Excellent communication skills, including a strong ability to communicate executive and/or detailed level findings to clients; ability to effectively communicate tasks, guidance, and methodology with internal teams.</li></ul>
Additionally, background in at least one of the following domains is required:<ul><li>
Threat Hunting: experience conducting, developing, or managing adversary threat hunting engagements, in either an internal security or consulting environment.</li><li>
Incident Response: experience conducting incident response investigations for organizations, investigating targeted threats such as the Advanced Persistent Threat (APT), Organized Crime, and Hacktivists.</li><li>
Threat Research: analyzing cloud threats, tracking attack campaigns, conducting vulnerability research, and developing attack techniques.</li><li>
Detection Engineering: creating and implementing detection logic in tools, testing detection against known threats, and managing detection content lifecycle.</li></ul>
Education &amp; Certifications:
BA or BS / MA or MS degree in Computer Science, Computer Engineering, Math, Information Security, Information Assurance, Information Security Management, Intelligence Studies, Cybersecurity, Cybersecurity Policy, or a related field. Applicants without a degree but with relevant work experience and/or training will be considered.
Holders of a CISSP, CISA, CISM, CCSP, or any practitioner or security certifications in AWS, Azure and GCP may be considered in lieu of or in addition to a degree.
#LI-AC1
#LI-Remote
This role may require the candidate to periodically undergo and pass alcohol and/or drug test(s) during the course of employment.
Benefits of Working at CrowdStrike:<ul><li>
Market leader in compensation and equity awards</li><li>
Comprehensive physical and mental wellness programs</li><li>
Competitive vacation and holidays for recharge</li><li>
Paid parental and adoption leaves</li><li>
Professional development opportunities for all employees regardless of level or role</li><li>
Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections</li><li>
Vibrant office culture with world class amenities</li><li>
Great Place to Work Certified&trade; across the globe</li></ul>
CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program.
CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions-including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs-on valid job requirements.
If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at recruiting@crowdstrike.com for further assistance.
Find out more about your rights as an applicant.
CrowdStrike participates in the E-Verify program.
Notice of E-Verify Participation
Right to Work
CrowdStrike, Inc. is committed to fair and equitable compensation practices. Placement within the pay range is dependent on a variety of factors including, but not limited to, relevant work experience, skills, certifications, job level, supervisory status, and location. The base salary range for this position for all U.S. candidates is $140,000 - $195,000 per year, with eligibility for bonuses, equity grants and a comprehensive benefits package that includes health insurance, 401k and paid time off.
For detailed information about the U.S. benefits package, please click here.
Expected Close Date of Job Posting is:06-09-2026</div>

Cloud Threat Hunting Principal Consultant (Remote)

NKU Technologies Pvt.Ltd.

We are seeking a skilled Security Consultant (Offensive Security) with 5&ndash;7 years of experience to support and deliver client-facing security assessment services. This role will work closely with the Lead Penetration Tester/CISO to execute penetration tests, vulnerability assessments, and threat hunting activities, while also contributing to external threat intelligence efforts such as dark web and online community monitoring. The ideal candidate will have strong technical expertise and the ability to independently execute tasks while supporting engagement leadership.Key Responsibilities:<ul><li>Support the Lead Penetration Tester in planning, scoping, and executing client engagements.</li><li>Participate in defining testing strategies, methodologies, and rules of engagement.</li><li>Act as a secondary point of contact for clients during assessments.</li><li>Perform penetration testing across web applications, networks, APIs, and cloud environments.</li><li>Conduct vulnerability assessments and validate findings through manual testing.</li><li>Execute portions of red team or adversary simulation exercises under guidance.</li><li>Perform proactive threat hunting to identify indicators of compromise (IOCs) and suspicious activities.</li><li>Analyze logs, endpoint data, and network traffic to detect potential threats.</li><li>Support development of threat hunting hypotheses and detection use cases.</li><li>Conduct monitoring and targeted searches across dark web sources, forums, and platforms such as Discord.</li><li>Identify potential data leaks, credential exposure, and threat actor activity relevant to clients.</li><li>Correlate external intelligence with internal findings to enhance overall risk visibility.</li><li>Prepare detailed technical reports with clear findings and remediation recommendations.</li><li>Support the Lead in presenting results to client stakeholders.</li><li>Translate technical vulnerabilities into business risk where required.</li><li>Perform re-testing to validate remediation efforts.</li><li>Contribute to internal playbooks, tools, and methodologies.</li><li>Stay current with emerging threats, tools, and offensive security techniques.</li></ul>Required Qualifications:<ul><li>Bachelor&rsquo;s degree in Cybersecurity, Information Security, IT, or equivalent experience.</li><li>5&ndash;7 years of hands-on experience in penetration testing, vulnerability assessment, or offensive security.</li><li>Experience working in a client-facing or consulting environment.</li><li>Strong understanding of network security, application security, and system architecture.</li><li>Hands-on experience with tools such as Burp Suite, Metasploit, Nmap, Nessus, Wireshark, and similar.</li><li>Familiarity with frameworks such as OWASP Top 10, MITRE ATT&amp;CK, and CVSS.</li><li>Experience with OSINT, threat intelligence, or dark web monitoring is a plus.</li></ul>Preferred Certifications:<ul><li>OSCP (or working toward it)</li><li>CEH, GPEN, or GWAPT</li><li>Other relevant offensive security certifications</li></ul>Key Skills:<ul><li>Strong technical and analytical skills</li><li>Ability to work independently while collaborating with senior team members</li><li>Good client communication and reporting skills</li><li>Attention to detail and risk-based thinking</li></ul>Nice to Have:<ul><li>Experience with cloud security (AWS, Azure, GCP)</li><li>Scripting skills (Python, PowerShell, Bash)</li><li>Exposure to SIEM/EDR platforms</li><li>Experience with red teaming or adversary simulation</li></ul>Pay: From Rs250,000.00 per monthWork Location: In person

Cyber Security Officer

INFRA ASSURE

JOB TITLE: Cyber Threat Intelligence (CTI) SpecialistLOCATION: Qatar / Remote | TYPE: Contract / Full-time | LEVELS: 3&ndash;5 yrs / 5&ndash;10 yrs / 10&ndash;20 yrsABOUT THE ROLEWe are recruiting a Cyber Threat Intelligence Specialist to provide a government client in Qatar with timely, contextualized intelligence on threats relevant to their environment. You will function as the primary point for strategic, operational, and tactical threat intelligence &mdash; supporting SOC, Incident Response, and leadership with actionable intelligence products and driving threat-informed defence.KEY RESPONSIBILITIES- Collect and correlate threat data from internal telemetry, OSINT, commercial feeds, and community/government sources.- Analyze threat actors, campaigns, malware, and TTPs, mapping them to MITRE ATT&amp;CK and to client assets and use cases.- Produce intelligence reports, alerts, and advisories including IOCs, recommended countermeasures, and risk context.- Enrich SOC detections and SIEM/EDR rules with contextual intelligence to improve detection fidelity and prioritization.- Collaborate with Incident Response to provide adversary profiles, pivot points, and hypotheses during active investigations.- Lead or support threat-hunting exercises using intelligence-driven hypotheses to proactively search for unknown compromises.- Maintain an intelligence knowledge base tracking trends, historical incidents, and lessons learned.REQUIRED EXPERIENCE- 3&ndash;20 years of experience in threat intelligence, threat hunting, or security operations.- Deep knowledge of MITRE ATT&amp;CK, threat actor TTPs, and intelligence lifecycle management.- Hands-on experience with OSINT tools and techniques for adversary research.- Experience with SIEM platforms, threat intelligence platforms (TIPs), and IOC management.- Ability to produce both technical and strategic intelligence reports for varied audiences.- Experience analyzing malware, phishing campaigns, and nation-state or APT group activity.- Familiarity with threat-sharing frameworks: STIX/TAXII, MISP, or equivalent.- Government or critical infrastructure sector experience is a strong advantage.PREFERRED CERTIFICATIONSCandidates holding two or more of the following certifications will be viewed very favourably:- GCTI (GIAC Cyber Threat Intelligence) - the most directly relevant cert for this role- CTIA (Certified Threat Intelligence Analyst, EC-Council) - strongly preferred- GOSI (GIAC Open Source Intelligence) - valued for OSINT-heavy work- CISSP - valued for senior-level candidates (Level 1)- CISM - valued for senior candidates bridging intelligence and governance- CompTIA Security+ - good baseline for Level 3 candidates entering CTI from SOCWHAT WE OFFER- Engagement supporting a high-profile government client in Qatar.- Multiple experience levels considered: junior (3&ndash;5 yrs), mid (5&ndash;10 yrs), and senior (10&ndash;20 yrs).- Competitive contract rate aligned with experience level.- Opportunity to work on national-scale threat intelligence programmes.Job Type: Full-timeApplication Question(s):<ul><li>How soon can you join if selected?</li></ul>Work Location: Remote

Cyber Threat Intelligence (CTI) Specialist

Walgreens

<div>Job Summary
 
This role supports Walgreens&rsquo; Threat Detection and Response function, focusing on investigating and responding to security incidents across the enterprise.
 
As a senior-level individual contributor, you will serve as an escalation point, owning incidents end to end from triage through root cause analysis and remediation. Requiring hands-on expertise, strong judgment, and the ability to operate independently.
 
You will build detection capabilities, proactively hunt for threats, and improve response effectiveness through automation. This work spans hybrid infrastructure, applications, and enterprise systems, using log analysis, behavioral signals, and threat intelligence to identify and mitigate risk.
 
 
Key responsibilities include:
<ul><li>Designing and implementing detection across enterprise environments
</li><li>Developing automation to improve detection and response efficiency
</li><li>Leading incident response efforts and driving investigations to resolution
</li><li>Partnering with cross-functional teams to improve logging, telemetry, and observability
</li><li>Conducting proactive threat hunting and operationalizing findings into detections
</li><li>Mentoring team members and contributing to overall team capability
</li></ul>Success in this role requires the ability to operate effectively in ambiguous situations, take ownership of work, and independently drive outcomes. The ideal candidate is comfortable navigating complex environments, identifying gaps, and developing solutions that strengthen the organization&rsquo;s security posture.
 
 
Location Requirement:
 
This is a hybrid role based in Deerfield, IL (Walgreens Corporate Office), with 4 days onsite and 1 day remote.
 
 
Work Authorization:
 
Work visa sponsorship is not available for this role.
 
 
Job Responsibilities:
<ul><li>Monitors, identifies, investigates and analyzes all response activities related to cybersecurity incidents within the organization that require broad expertise or unique knowledge.</li>
<li>Identifies security flaws and vulnerabilities; responds to cybersecurity incidents, conducts threat analysis as directed and addresses detected incidents.</li>
<li>Evaluates event flows to identify common to advanced risks and vulnerabilities to develop and implement solutions.</li>
<li>Provides assistance in monitoring the security of all designated networks and systems.</li>
<li>May prepare detailed incident reports and technical briefs for the IT security team. May present issues to team</li>
<li>This role works on significant and unique issues where analysis of situations or data requires an evaluation of intangibles. Exercises independent judgment in methods, techniques and evaluation criteria for obtaining results.</li>
<li>Assists with security audits, risk analysis, network forensics and penetration testing.</li>
<li>Creates formal networks involving coordination among groups.</li>
<li>May indirectly supervise other Specialists.</li>
<li>Provides subject matter expertise and insight to clients about industry attack trends and defenses by developing and maintaining deep awareness and understanding of evolving threats, adversaries and intrusion trends. Provides subject matter expertise to less experienced team members. May participate in teaching and training members of the work team.</li>
</ul>About Walgreens
 
Founded in 1901, Walgreens (www.walgreens.com) has a storied heritage of caring for communities for generations and proudly serves nearly 9 million customers and patients each day across its approximately 8,500 stores throughout the U.S. and Puerto Rico, and leading omni channel platforms. Walgreens has approximately 220,000 team members, including nearly 90,000 healthcare service providers, and is committed to being the first choice for retail pharmacy and health services, building trusted relationships that create healthier futures for customers, patients, team members and communities.
 
 
Basic Qualifications
 
<ul><li>Bachelor&rsquo;s degree and at least 4 years of Information/Cyber Security experience OR a High School Diploma/GED and at least 7 years of experience in Information/Cyber Security</li>
<li>At least 3 years of Cyber Security experience in at least three of the following: Active threat hunting (open source or commercial tooling), Intrusion analysis, Managed or enterprise information security services, Incident response, Endpoint forensics (Windows, MAC, or Linux), Malware analysis, Penetration testing, Network defense, Threat hunting, Information security consulting</li>
<li>Experience establishing &amp; maintaining relationships with individuals at all levels of the organization, in the business community &amp; with vendors.</li>
<li>Experience using time management skills such as prioritizing/organizing and tracking details and meeting deadlines of multiple projects with varying completion dates</li>
<li>Experience analyzing and reporting data in order to identify issues, trends, or exceptions to drive improvement of results and find solutions.</li>
<li>Willing to travel up to/at least 10% of the time for business purposes (within state and out of state).</li> 
</ul> 
 
Preferred Qualifications
 
Preferred Qualifications:
<ul><li>Experience building and tuning detection logic (rules, alerts, behavioral analytics) across hybrid environments using SIEM platforms such as Splunk or Microsoft Sentinel</li>
<li>Experience automating workflows, including converting manual playbooks into code using Python or similar languages</li>
<li>Strong understanding of attacker TTPs, threat hunting methodologies, and malware analysis techniques to inform detection engineering and response operations</li>
<li>Experience mentoring and developing junior team members through knowledge sharing, training programs, and tabletop exercises</li>
<li>GCIH, GCTI, GCFA, GCDA, GCED, CISSP, CISM, CySA+, or equivalent industry certification</li>
</ul>Additional Preferred Experience:
<ul><li>Cloud security monitoring and investigations across IaaS, PaaS, and SaaS environments</li>
<li>Familiarity with containerized, serverless, or microservices architectures and their unique detection challenges</li>
<li>Experience with distributed systems observability, telemetry pipelines, and large-scale log analysis</li>
</ul>Leadership &amp; Behavioral Attributes:
<ul><li>Maintains composure and sound decision-making under pressure, including during active incidents and ambiguous scenarios</li>
<li>Operates with independence and ownership, driving work through resolution</li>
<li>Identifies gaps in detection coverage, processes, or tooling and proactively drives improvements</li>
<li>Communicates technical findings clearly to technical and non-technical audiences</li>
<li>Fosters a culture of continuous improvement through retrospectives, documentation, and knowledge sharing</li>
<li>Builds trusted relationships across security, engineering, and business teams to enable effective cross-functional incident response</li>
</ul>We will consider employment of qualified applicants with arrest and conviction records.
 
 
#LI-JW1
 
Salary Range: $88700 - $141800 / Salaried</div>
 <div><h2 class="jobSectionHeader">Benefits</h2>
<ul><li><h3 class="jobSectionHeader">Health, dental and vision*</h3></li>
<li><h3 class="jobSectionHeader">Retirement Savings Plan (401(k))</h3></li>
<li><h3 class="jobSectionHeader">Paid time off benefits</h3></li>
<li><h3 class="jobSectionHeader">Onsite fitness center and health center</h3></li>
<li><h3 class="jobSectionHeader">Work &amp; life resources</h3></li>
<li><h3 class="jobSectionHeader">Employee discount</h3></li>
</ul><ul><li>with a 30-hour work week</li></ul></div>

Senior Cyber Security Specialist I - Threat Detection and Response

Octdaily

<div>
 
 Job Description:
 
 <ul>
 <li>
 Design, deploy and optimize Microsoft Sentinel for SIEM and SOAR capabilities.
 </li>
 <li>
 Develop and implement advanced detection use cases aligned with MITRE ATT&amp;CK framework.
 </li>
 <li>
 Monitor and analyze security events across endpoint, network, identity, database and DevOps environments.
 </li>
 <li>
 Build and fine tune KQL based detection rules and threat hunting queries.
 </li>
 <li>
 Identify threats such as lateral movement, command and control activity, suspicious sign ins and data exfiltration.
 </li>
 <li>
 Design and implement security policies and monitoring strategies based on business risk.
 </li>
 <li>
 Integrate Microsoft Defender XDR, Azure services and third party security tools.
 </li>
 <li>
 Develop and manage SOAR playbooks using Logic Apps for automated response.
 </li>
 <li>
 Implement Data Loss Prevention using Microsoft Purview and manage endpoint security via Intune.
 </li>
 <li>
 Work on DevSecOps integrations including Azure DevOps, APIs and Infrastructure as Code.
 </li>
 <li>
 Deploy and manage on premise SIEM solutions such as Wazuh in hybrid environments.
 </li>
 <li>
 Ensure continuous improvement of detection capabilities and security posture.
 </li>
 </ul>
 
 
 
 
 Requirements:
 
 <ul>
 <li>
 3 to 4 years of relevant experience in SIEM or cybersecurity roles.
 </li>
 <li>
 Strong hands on experience with Microsoft Sentinel and KQL.
 </li>
 <li>
 Expertise in Microsoft Defender XDR including Endpoint, Identity, O365 and Cloud.
 </li>
 <li>
 Experience in SIEM implementation, detection engineering and policy design.
 </li>
 <li>
 Solid understanding of network security, endpoint telemetry and cloud security.
 </li>
 <li>
 Familiarity with MITRE ATT&amp;CK framework.
 </li>
 <li>
 Experience with automation, DevOps security and API integrations.
 </li>
 <li>
 Strong analytical, problem solving and communication skills.
 </li>
 </ul>
 
 
</div>

Siem Engineer

WENCOR

<div>
 For 68 years, HEICO Corporation, a NYSE traded company, has thrived by serving niche segments of the aviation, defense, space and electronics industries by providing innovative and cost-saving products and services. HEICO&rsquo;s high-energy culture focuses our Team Members on providing high quality products and services to our customer base, which is made up of most of the world&rsquo;s airlines, the defense industry, satellite manufacturers and other electronics companies. Our leadership approach creates a dynamic environment that continually challenges our Team Members to grow professionally and develop in an entrepreneurially-spirited setting.
 
 
 
 ROLE:
 
 The
 
 Senior IT Security Analyst
 
 applies advanced systems analysis techniques and deep cybersecurity operations expertise to protect sensitive and mission-critical systems across HEICO and its subsidiaries. This role serves as a senior technical escalation point for security monitoring and incident response, leads complex investigations, and drives continuous improvement of detection, response, and security hardening capabilities.
 
 
 The Senior IT Security Analyst acts as a trusted advisor and liaison to ensure security operations align with HEICO standards while accounting for subsidiary-specific business needs and technical nuances. The role mentors junior analysts, improves operational rigor (playbooks, automation, metrics), and supports compliance-driven security requirements through disciplined execution and documentation.
 
 
 
 Essential Duties And Responsibilities
 
 
 
 <li>
 Security Monitoring &amp; Triage
 </li>
 <ul>
 <li>
 Analyze and triage security alerts from managed detection and response (MDR) services and internal monitoring platforms; determine severity, scope, and required actions.
 </li>
 <li>
 Serve as an escalation point for high-impact or complex alerts and investigations; provide guidance to junior analysts during active cases.
 </li>
 </ul>
 <li>
 Incident Response Leadership
 </li>
 <ul>
 <li>
 Lead cybersecurity incident investigations, including evidence preservation, containment, eradication, and recovery validation in accordance with established procedures.
 </li>
 <li>
 Coordinate incident communications and technical actions across IT teams, impacted sites, and third-party providers; ensure timely escalation when elevated authorization is required.
 </li>
 <li>
 Perform post-incident reviews, document timelines and lessons learned, and implement improvements to reduce recurrence.
 </li>
 </ul>
 <li>
 Threat Investigation &amp; Analysis
 </li>
 <ul>
 <li>
 Conduct malware and suspicious artifact analysis using investigative tooling (including sandboxing) to determine behavior, impact, and mitigation steps.
 </li>
 <li>
 Perform proactive threat hunting to identify stealthy or low-signal adversary activity and improve detection coverage.
 </li>
 </ul>
 <li>
 Detection Engineering &amp; Security Tool Optimization
 </li>
 <ul>
 <li>
 Evaluate, tune, and optimize EDR/XDR detection logic, response policies, and automated containment actions to improve efficacy and reduce false positives.
 </li>
 <li>
 Enhance alert fidelity and investigative effectiveness through rule refinement, contextual enrichment, telemetry validation, and playbook improvements.
 </li>
 <li>
 Design and maintain application control and endpoint protection policies to strengthen visibility, restrict unauthorized software execution, and address detection or response gaps.
 </li>
 <li>
 Security Automation
 </li>
 <ul>
 <li>
 Develop, test, and implement SOAR/security automation workflows to improve response consistency and enable action when staffing is limited.
 </li>
 <li>
 Identify repetitive analyst tasks and implement automation to increase operational capacity and reduce mean time to respond (MTTR).
 </li>
 </ul>
 <li>
 Incident-Driven Vulnerability Escalation
 </li>
 <ul>
 <li>
 Escalate vulnerabilities or control weaknesses identified during incident response or threat hunting, providing technical impact analysis and attack-path context to the vulnerability management function.
 </li>
 <li>
 Confirm that remediation actions adequately address the specific incident vector or exploited control gap.
 </li>
 </ul>
 <li>
 Control Gap Identification &amp; Advisory
 </li>
 <ul>
 <li>
 Provide operational feedback on control effectiveness based on real-world incident activity and detection gaps (including emerging technology guidance such as AI usage controls).
 </li>
 <li>
 Recommend improvements to technical safeguards or enforcement mechanisms when investigative findings reveal system weaknesses (e.g., SOX and NIST-aligned requirements).
 </li>
 </ul>
 <li>
 Third-Party / MSP Oversight
 </li>
 <ul>
 <li>
 Engage third-party IT providers/MSPs to communicate HEICO security requirements and incident handling expectations (including evidence retention).
 </li>
 <li>
 Assess MSP execution against requirements, identify gaps, and escalate non-compliance through appropriate channels.
 </li>
 </ul>
 <li>
 Business Partnership, Reporting, and Travel
 </li>
 <ul>
 <li>
 Act as a liaison between HEICO Corporate security and supported subsidiaries to maintain alignment on security initiatives, upgrades, and operational expectations.
 </li>
 <li>
 Provide regular operational reporting (risk trends, incident metrics, remediation status, tooling effectiveness).
 </li>
 <li>
 Required quarterly travel to supported out-of-state sites (i.e. quarterly planned visits and additional travel during escalations) to understand environment baselines, strengthen stakeholder relationships, and improve response readiness.
 </li>
 </ul>
 <li>
 On-Call Support
 </li>
 <ul>
 <li>
 Participate in an on-call rotation and respond independently to security events outside standard business hours.
 </li>
 <li>
 Perform other professional cybersecurity duties consistent with the scope and level of the position.
 </li>
 </ul>
 </ul>
</div>

IT Security Operations Analyst

Search 788+ Threat hunter jobs near you this April. New roles added regularly across leading industries. Apply today.