Franklin Templeton - IT Security Analyst - SIEM/SOAR

Principal IS Analyst IT Security

Position Title

Principal IS Analyst IT Security

Department / Team

R&T Global Info Security / Security Operations Center

Experience

8-10 years of hands-on experience in Security Operations, Incident Response, Threat Detection, Threat Hunting, Detection Engineering, and related cybersecurity operations roles.

Working Model

24x7 SOC environment with responsibility for supporting major incidents, security events, and operational initiatives.

Role Scope

Provide technical leadership across Security Operations through advanced cyber threat detection, incident response, threat hunting, and continuous improvement of detection and response capabilities. The role contributes to the evolution of SOC processes, monitoring capabilities, investigation methodologies, and operational effectiveness while collaborating across security and technology teams to strengthen the organization's cyber resilience.

Role Summary

The role is responsible for providing advanced technical expertise across security monitoring, threat detection, incident response, and threat hunting within a 24x7 Security Operations Center. It requires deep analytical and investigative capabilities to identify, analyze, and respond to sophisticated cyber threats across endpoints, networks, cloud, identity, email, applications, and enterprise security technologies.

The role contributes to the continued advancement of Security Operations by improving detection strategies, investigation methodologies, automation, operational processes, and threat hunting capabilities. It also provides technical guidance during complex security incidents, supports cross-functional cyber security initiatives, and helps strengthen the organization's overall detection and response maturity.

Core Objective

Advance the organization's Security Operations capabilities by strengthening cyber threat detection, incident response, threat hunting, and operational effectiveness while continuously improving SOC maturity, detection coverage, and cyber resilience.

What is the Security Operations Center (SOC) responsible for

The SOC is responsible for continuously monitoring and improving the organizations security posture by preventing, detecting, analyzing, and responding to cybersecurity incidents using security tools, threat intelligence, defined processes, and operational response capabilities.

Key Responsibilities

• Lead investigations and response for escalated security incidents, providing technical direction and coordination throughout the incident lifecycle.
• Perform advanced investigation and analysis of suspicious activity across endpoints, networks, identity, email, cloud, applications, and enterprise security technologies to identify sophisticated threats and determine scope, impact, and root cause.
• Lead proactive threat hunting activities using threat intelligence, indicators of compromise, attacker tactics, techniques and procedures (TTPs), behavioral analytics, and frameworks such as MITRE ATT&CK.
• Design, review, and continuously improve SIEM, EDR/XDR, and related detection rules, correlation logic, alert thresholds, monitoring use cases, and detection strategies to improve detection effectiveness and reduce false positives.
• Identify gaps in logging, monitoring, detection coverage, investigation methodologies, escalation processes, and response capabilities, recommending and driving improvements to strengthen Security Operations.
• Perform root cause analysis for significant security incidents and document findings, evidence, attack timelines, impact assessments, remediation recommendations, and lessons learned.
• Develop and maintain advanced SOC playbooks, investigation methodologies, response procedures, knowledge articles, and technical standards to improve investigation consistency and operational maturity.
• Collaborate with Security Engineering, Infrastructure, Cloud, Identity, Application, and other technology teams to enhance detective controls, monitoring capabilities, incident response readiness, and overall cyber resilience.
• Evaluate emerging threats, attack techniques, and security technologies, translating intelligence into improved monitoring, detection, and response capabilities.
• Provide technical guidance and mentorship to SOC analysts, promoting knowledge sharing, investigation quality, and consistent operational practices.
• Ensure investigation activities, technical findings, evidence, decisions, and stakeholder communications are accurately documented within case management and ticketing systems.
• Contribute to the continuous improvement of Security Operations through automation opportunities, operational enhancements, and adoption of industry best practices.

Required Qualifications and Experience

• Educational background in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, preferably with cybersecurity-focused coursework Prin