Note: The job is a remote job and is open to candidates in USA. Deepwatch is a managed security services provider that protects organizations from cyber threats. The Security Analyst III investigates and responds to security incidents, escalates alert triage, and supports customers and analysts with recommendations, training, and improved security operations.
Responsibilities
- Act as an escalation point for alert triage processes across security technologies and multiple platforms including Windows, Linux and macOS
- Provide in depth analysis from escalated requests originating from any team member who needs support
- Validate suspicious events by performing investigations using SIEM and SOAR technologies
- Leverage Deepwatch proprietary tooling, OSINT, TTPs and IOCs
- Act as a key resource for Management, providing opportunities for improvement and actionable recommendations on creating efficiencies
- Identify gaps in customer environments, data ingested or configuration errors which reduce telemetry quality
- Collaborate directly with leadership and customers to highlight and resolve security concerns
- Provide investigative support to analysts and train others on a regular basis
- Produce high-quality written and verbal communications, recommendations, and findings to customer management in a timely manner
- Further hone your skills and capabilities through hands-on experience and the Deepwatch learning & development program
- Engage in peer review sessions to evolve and enhance analysis quality
Skills
- Possess strong understanding of cyber security principles, concepts and practices which includes the ability to perform a complete and thorough incident investigation and triage as the final point of escalation
- Possess comprehensive knowledge of Splunk SIEM, alongside the capability to utilize alternative platforms like Google SecOps or Microsoft Sentinel, ensuring smooth console navigation, optimized query execution for streamlined investigations, and precise alert evaluations
- Have working knowledge of modern EDR tools like CrowdStrike & SentinelOne, email security, and cloud identity platforms
- Have confidence to autonomously resolve complex investigations
- Effectively meet client expectations ensuring action items are tracked to completion while maintaining transparent communication with peers and leadership
- Have advanced knowledge of Adversary Tactics, Techniques, & Procedures (TTP), Event Logging, and Event Triage
- Demonstrate the ability to pivot to other log sources, cloud systems or consoles to perform a comprehensive analysis from multiple data sources
- A desire to support others and uplift the program and team through updating training materials and SOPs
- Hands-on experience utilizing enterprise ticketing systems such as ServiceNow, Jira, or similar case management tools
- Demonstrate the ability to write well-written reports and analysis that's thorough, accurate and complete
- Preferred Certifications: Security X, CySA+, GCSA, GCIH
- Experience in an MDR or MSSP environment is highly desirable
Benefits
- Medical, dental, vision, and disability insurance
- Flexible Time Off (FTO), 12 company holidays, sick leave and 8-Weeks Paid Parental Leave
- Annual “development dollars” to support our people growth and development
- Wellness contests and monthly educational programs
- 401(K) retirement program
- Stock options
- Hybrid in Tampa: 3 days a week in the Tampa Center of Excellence (your choice of days), and 2 days remote
- 100% remote work open to US remote talent; no relocation to Tampa is required for remote hires
Company Overview