IT Security Analyst - Cybersecurity

Principal IS Analyst IT SecurityDepartment / Team:R&T Global Info Security / Security Operations CenterExperience:8-10 years of hands-on experience in Security Operations, Incident Response, Threat Detection, Threat Hunting, Detection Engineering, and related cybersecurity operations roles.Working Model:24x7 SOC environment with responsibility for supporting major incidents, security events, and operational initiatives.Role Scope:Provide technical leadership across Security Operations through advanced cyber threat detection, incident response, threat hunting, and continuous improvement of detection and response capabilities. The role contributes to the evolution of SOC processes, monitoring capabilities, investigation methodologies, and operational effectiveness while collaborating across security and technology teams to strengthen the organization's cyber resilience.Role Summary:The role is responsible for providing advanced technical expertise across security monitoring, threat detection, incident response, and threat hunting within a 24x7 Security Operations Center. It requires deep analytical and investigative capabilities to identify, analyze, and respond to sophisticated cyber threats across endpoints, networks, cloud, identity, email, applications, and enterprise security technologies.The role contributes to the continued advancement of Security Operations by improving detection strategies, investigation methodologies, automation, operational processes, and threat hunting capabilities. It also provides technical guidance during complex security incidents, supports cross-functional cyber security initiatives, and helps strengthen the organization's overall detection and response maturity.Advance the organization's Security Operations capabilities by strengthening cyber threat detection, incident response, threat hunting, and operational effectiveness while continuously improving SOC maturity, detection coverage, and cyber resilience.What is the Security Operations Center (SOC) responsible for :The SOC is responsible for continuously monitoring and improving the organizations security posture by preventing, detecting, analyzing, and responding to cybersecurity incidents using security tools, threat intelligence, defined processes, and operational response capabilities.Lead investigations and response for escalated security incidents, providing technical direction and coordination throughout the incident lifecycle.- Perform advanced investigation and analysis of suspicious activity across endpoints, networks, identity, email, cloud, applications, and enterprise security technologies to identify sophisticated threats and determine scope, impact, and root cause.- Lead proactive threat hunting activities using threat intelligence, indicators of compromise, attacker tactics, techniques and procedures (TTPs), behavioral analytics, and frameworks such as MITRE ATT&CK.- Design, review, and continuously improve SIEM, EDR/XDR, and related detection rules, correlation logic, alert thresholds, monitoring use cases, and detection strategies to improve detection effectiveness and reduce false positives.- Identify gaps in logging, monitoring, detection coverage, investigation methodologies, escalation processes, and response capabilities, recommending and driving improvements to strengthen Security Operations.- Perform root cause analysis for significant security incidents and document findings, evidence, attack timelines, impact assessments, remediation recommendations, and lessons learned.- Collaborate with Security Engineering, Infrastructure, Cloud, Identity, Application, and other technology teams to enhance detective controls, monitoring capabilities, incident response readiness, and overall cyber resilience.- Evaluate emerging threats, attack techniques, and security technologies, translating intelligence into improved monitoring, detection, and response capabilities.- Provide technical guidance and mentorship to SOC analysts, promoting knowledge sharing, investigation quality, and consistent operational practices.- Contribute to the continuous improvement of Security Operations through automation opportunities, operational enhancements, and adoption of industry best practices.Required Qualifications and Experience:- Educational background in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, preferably with cybersecurity-focused coursework, specialization, or practical security exposure.- 8-10 years of progressive hands-on experience in Security Operations, incident response, threat detection, security monitoring, threat hunting, detection engineering, or related cybersecurity operations roles.- Extensive hands-on experience with SIEM, SOAR and EDR/XDR platforms, including advanced investigation, incident response, threat analysis, and evidence collection.- Strong understanding of security operations concepts, including threat detection, incident response Principal