About the position
Upstream Security is hiring a Senior SOC Analyst for its managed cybersecurity services team. The role investigates and responds to cybersecurity incidents involving connected vehicles, mobility applications, backend services, and APIs. The analyst serves as a security focal point for customers, leads complex investigations, improves detection capabilities, and helps deploy and maintain agentic AI workflows used in SOC operations. This is a full-time, hybrid position based in Michigan, USA.
Responsibilities
• Monitor, investigate, and respond to vehicle and API security alerts.
• Lead complex investigations, assess impact, identify root causes, and provide actionable mitigation recommendations.
• Analyze suspicious vehicle behavior, API activity, authentication events, and mobility-related telemetry.
• Investigate API threats, including authorization abuse, credential attacks, injection, data exposure, automation, and business-logic abuse.
• Deploy, configure, test, and maintain agentic AI workflows supporting alert triage, investigations, threat hunting, reporting, and response.
• Monitor the accuracy, reliability, and operational performance of AI-driven workflows and improve their prompts, tools, guardrails, and decision logic.
• Conduct proactive threat hunting and OSINT investigations to identify emerging threats and attack patterns.
• Develop and maintain investigation playbooks, operational procedures, and response processes.
• Tune detection logic, behavioral profiles, and machine-learning models to improve detection quality and reduce false positives.
• Produce investigation reports, incident updates, dashboards, and executive-level summaries.
• Act as a trusted security advisor to customers during investigations, workshops, and business reviews.
• Mentor analysts and promote consistent investigation quality across the SOC.
• Track operational performance against SLAs, quality standards, and SOC KPIs.
• Collaborate with threat intelligence, research, product, engineering, and customer-facing teams to improve Upstream’s security capabilities.
Requirements
• At least 3 years of experience in SOC operations, incident response, threat hunting, or security investigations.
• Previous customer-facing analyst experience, preferably within an MSSP, consulting, or professional services context.
• Strong practical understanding of APIs, including REST, authentication, authorization, OAuth, and JWT.
• Hands-on API security experience with technologies such as WAFs, API gateways, API security platforms, SIEM, Burp Suite, or similar tools.
• Experience investigating common API threats, including account abuse, authorization flaws, injection, data exposure, and business-logic attacks.
• Experience with SIEM, SOAR, XDR, security automation, and large-scale data analysis.
• Experience deploying or maintaining automation, AI-assisted, or agentic AI workflows.
• Scripting experience, preferably with Python or SQL.
• Ability to lead complex investigations and operate effectively in high-pressure environments.
Nice-to-haves
• Experience in automotive, mobility, IoT, cloud security, mobile application security, or managed security services.
• Customer-facing analyst experience in English.