Principal Threat Analyst | Remote, USA

Role overview

Conduct advanced security monitoring, incident response, and proactive threat hunting across client environments in a managed security operations setting. The principal analyst investigates activity across varied data sources, improves detection methods, reviews team investigations, and advises on defensive controls. The role works across distributed teams and supports clients in multiple industries.

Responsibilities

- Monitor client networks and investigate incidents using security telemetry, audit records, and monitoring tools. - Hunt for malicious activity, document findings, and develop repeatable methods for detecting threats. - Review investigations by less experienced analysts and help maintain analysis quality. - Recommend detection, protection, and control improvements, including tuning use cases and reducing attack surface. - Present technical topics and response recommendations to both technical and nontechnical audiences. - Mentor colleagues, support major engineering initiatives, and follow documented escalation and remediation procedures.

Requirements

- Typically 7–10 years of related experience, including at least six years assessing, reviewing, or remediating infrastructure vulnerabilities and risks. - Knowledge of common vulnerabilities, CVE and CVSS concepts, compensating controls, security frameworks, and network or server threats. - Familiarity with Windows or Linux systems, security controls, and logging and monitoring technologies. - Advanced understanding of adversary tactics and techniques and the telemetry or controls that can reveal them. - Strong investigation, analytical, prioritization, communication, and teamwork skills; able to manage multiple urgent tasks. - Willingness to travel to meet client needs, approximately 10% as described in the source.

Nice to have

- Experience with threat hunting, endpoint investigations, phishing analysis, malware analysis, MITRE ATT&CK, and security use case design. - Exposure to endpoint, cloud, SaaS, user behavior, packet analysis, threat intelligence, or data visualization tools. - Familiarity with cloud services, insider threat or fraud investigations, and response playbooks.

Benefits and work setup

- Fully remote within the continental United States, with shift flexibility for a 24/7 operation, including rotating day, mid, and night coverage. - Training resources, remote-work technology, volunteer opportunities, and employee resource groups are listed.