Security Analyst II, CrowdStrike Next-Gen SIEM

Job Summary

The Security Analyst II serves as a dedicated security resource embedded within the clients security operations environment provided by Cyderes. This role acts as the primary point of contact for security incident management and response activities, working closely with the clients internal stakeholders and security vendors. The analyst will operate within the clients security tools and processes, leveraging Managed Detection and Response (MDR) services provided by MDR Service Provider (CrowdStrike) while coordinating response actions, investigations, and communications across multiple security functions. Success in this role requires a client-first mindset, strong ownership of security incidents, and the ability to collaborate effectively with external service providers and internal client teams.

Responsibilities

• Serve as a dedicated Security Analyst supporting the clients security operations and acting as an extension of the clients security team.
• Perform security event triage, investigation, and response activities utilizing alerts and findings generated by the MDR service providers.
• Act as the primary point of contact for all security incidents and coordinate response efforts across internal and external stakeholders.
• Review, validate, and take appropriate response actions based on incidents escalated to client.
• Conduct deep-dive investigations across endpoint, network, email, cloud, and identity platforms to determine the scope and impact of security incidents.
• Manage incident communications, documentation, and status updates throughout the incident lifecycle.
• Coordinate containment, eradication, and recovery activities with client IT and security teams.
• Work closely with Firewall Management teams to implement and validate security controls required during incident response activities.
• Coordinate with Email Security teams to investigate phishing threats, malicious email campaigns, and email-based compromises.
• Perform proactive threat hunting activities and identify indicators of compromise across the clients environment.
• Map observed threats and client use cases to the MITRE ATTCK framework and provide recommendations to enhance security posture.
• Collaborate security service providers to ensure investigation and resolution of security events.
• Maintain detailed incident records, lessons learned, and recommendations for improving detection and response capabilities.
• Develop trusted relationships with client stakeholders and provide security guidance aligned with business objectives.
• Stay current with emerging threats, attack techniques, and industry best practices.

Requirements

• 3+ years of experience in Security Operations Center (SOC), Incident Response, Threat Hunting, or Cybersecurity Operations roles.
• Experience working directly within client environments or as a dedicated security resource supporting enterprise customers.
• Strong understanding of Incident Response processes and lifecycle management.
• Experience working with SIEM solutions, preferably CrowdStrike Next Gen SIEM for log analysis, correlation, and investigation.
• Experience working with Endpoint Detection and Response (EDR) solutions, preferably CrowdStrike EDR.
• Experience collaborating with Managed Detection and Response (MDR) providers and managing escalations from external security service providers.
• Strong understanding of CrowdStrike Falcon platform and security operations workflows.
• Experience investigating phishing, malware, ransomware, account compromise, and insider threat incidents.
• Familiarity with email security platforms such as Proofpoint and common email threat vectors.
• Understanding of firewall technologies, such as PaloAlto, network security controls, and change management processes related to incident response.
• Strong knowledge of the MITRE ATTCK framework and adversary tactics, techniques, and procedures (TTPs).
• Coordinate with multiple teams and drive incident response activities to completion.
• Strong customer-facing and stakeholder management experience.
• Think from a client ownership perspective rather than a service provider perspective, taking accountability for security outcomes and business risk.
• Relevant certifications such as Security+, CEH, SC-200, GCIH, GCFA, or equivalent security certifications.
• Basic scripting or automation experience (PowerShell, Python, KQL, SPL).