Note: The job is a remote job and is open to candidates in USA. ECS is seeking a Cyber Threat Analyst (Tier 2) to support a multi-tenant Managed Security Services Provider environment protecting commercial customers and internal systems. The role serves as a senior investigator in the Security Operations Center, leading complex investigations and incident response activities, improving detection capabilities, managing customer investigations, and mentoring junior analysts.
Responsibilities
- Lead investigations involving malware, ransomware, business email compromise (BEC), account compromise, insider threats, cloud attacks, and advanced persistent threats
- Perform incident response activities including forensic triage, scope determination, evidence collection, containment recommendations, root cause analysis, and post-incident reporting
- Serve as the primary escalation point for Tier 1 analysts during complex investigations and security events
- Manage multiple concurrent customer investigations while meeting service-level objectives and communication requirements
- Coordinate response efforts with customers, IT teams, system administrators, and executive stakeholders
- Develop detailed technical incident reports, executive summaries, and customer-facing communications
- Conduct forensic triage across endpoints, servers, cloud platforms, email environments, and identity providers
- Analyze and correlate telemetry from SIEM, EDR, SOAR, NDR, cloud monitoring platforms, identity providers, email security tools, and threat intelligence sources
- Recommend, validate, test, and optimize detection content aligned with MITRE ATT&CK techniques and observed adversary behavior
- Conduct targeted threat hunts based on intelligence requirements, active investigations, or emerging threats, and contribute findings to detection improvement efforts
- Investigate security events across on-premises, cloud, SaaS, endpoint, network, and identity environments
- Analyze attacker behavior and map observed activity to MITRE ATT&CK techniques to support reporting, threat tracking, and investigation activities
- Utilize commercial and open-source threat intelligence to enrich investigations and identify emerging threats
- Collaborate with Detection Engineering and SOAR teams to improve alert fidelity, reduce false positives, and increase operational efficiency
Skills
- US. Citizenship with the ability to obtain and maintain a Secret Security Clearance
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field. Relevant experience may be substituted for education
- Minimum of 5 years of cybersecurity experience
- Minimum of 3 years supporting Security Operations Center (SOC), MSSP, MDR, Incident Response, Threat Detection, or Cyber Defense operations
- Strong understanding of modern attacker methodologies, threat actor tactics, techniques, and procedures (TTPs), and attack lifecycles
- Experience investigating cybersecurity incidents from initial detection through containment, eradication, and recovery
- Experience operating enterprise SIEM platforms including Microsoft Sentinel, Elastic, Splunk, QRadar, or equivalent technologies
- Experience with EDR technologies including Microsoft Defender for Endpoint, CrowdStrike Falcon, Trellix, SentinelOne, or equivalent platforms
- Experience with SOAR platforms, case management systems, and security automation technologies
- Experience investigating Microsoft 365, Entra ID, Azure, AWS, or hybrid-cloud environments
- Experience investigating identity-focused attacks including account compromise, privilege escalation, token abuse, suspicious authentication activity, and MFA-related attacks
- Strong understanding of Windows, Linux, networking, DNS, email security, web technologies, and cloud architectures
- Experience analyzing firewall, proxy, VPN, DNS, endpoint, NDR, identity, cloud, and authentication logs
- Experience creating custom detections using KQL, Sigma, SPL, Elastic Query Language, or equivalent detection technologies
- Ability to correlate events from multiple data sources and construct detailed attack timelines
- Ability to perform ad hoc scripting and automation using Python, PowerShell, or similar languages
- Strong written and verbal communication skills
- Ability to independently manage multiple concurrent investigations while meeting customer and operational requirements
Benefits
- Work remotely
Company Overview