Cybersecurity Senior Analyst (Remote/WFH)

Thumbtack; Philippines; On-site; PHP 4,367,000 - 6,862,000; Full time

Job summary

Thumbtack’s Security Engineering team is building a fast, high-fidelity detection and response capability. We’re looking for a Cybersecurity Senior Analyst to lead day-to-day security operations, tune our SIEM, and partner with an MDR provider to strengthen our security posture.

You’ll own incident response end-to-end, build detection-as-code, and apply AI tools to accelerate operations while collaborating with a distributed, US-based team.

Qualifications

• 6+ years in security operations, detection & response, or related field.
• Hands-on experience operating and tuning a SIEM, including detection engineering and log pipeline management.
• Experience managing or working closely with an MDR/MSSP partner, including escalation design and SLAs.
• Strong incident response skills across cloud-native environments (AWS and/or GCP), SaaS apps, endpoints, and identity systems.
• Fluency with AI tools in daily security work, and adaptability to evolve detections and tooling.
• Scripting and automation proficiency (e.g. Python) with SOAR playbooks or similar automation.
• Risk-based, analytical thinking and ability to prioritize critical signals over noise.
• Familiarity with GRC and compliance frameworks (SOC 2, PCI DSS) and vulnerability management; able to support them.
• Excellent written and verbal communication; ability to collaborate with a distributed, primarily US-based team.

Responsibilities

• Own day-to-day security operations: monitoring, triage, and investigation of security alerts across production, corporate, and SaaS environments.
• Manage and improve our SIEM: onboarding, parsing, normalization, detection rule tuning, and cost/coverage optimization.
• Manage MDR partnership: escalation workflows, SLAs, detection feedback loops, and quality of response.
• Lead security incidents end-to-end: triage, scoping, containment, eradication, recovery, post-incident reviews.
• Build automation to reduce toil: SOAR playbooks, detection-as-code pipelines, enrichment integrations, response scripting.
• Conduct proactive threat hunting informed by threat intel and Thumbtack’s environment.
• Define, track, and report operational metrics; use them to drive improvement.
• Apply AI tools to accelerate security operations and adapt detections and tooling for evolving threats.
• Collaborate with Security Engineering, Platform, IT, and Compliance to close gaps and improve posture.
• Support broader security program: GRC, endpoint security, network security, third-party risk, vulnerability management.

Skills

Security operations

SIEM tuning

MDR/MSSP

Incident response

Python scripting

AI tools

GRC familiarity

Communication

Tools

SIEM

SOAR

Job description

Thumbtack helps millions of people confidently care for their homes.

Thumbtack is the one app you need to take care of and improve your home — from personalized guidance to AI tools and a best-in-class hiring experience. Every day in every county of the U.S., people turn to Thumbtack to complete urgent repairs, seasonal maintenance and bigger improvements. We help homeowners know which projects to do, when to do them and who to hire from our growing community of 300,000 local service businesses. If making an impact inspires you, join us. Imagine what we’ll build together.

About the Cybersecurity Team

The Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe strong security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start.

We partner closely with Product, Engineering, Platform, and Data teams to shape system design, guide architectural decisions, and evolve Thumbtack’s security posture as the company scales. Through collaboration, automation, and thoughtful tradeoffs, we help ensure Thumbtack can ship fast, innovate boldly, and maintain customer trust.

About the role

As Thumbtack scales, the volume and variety of security telemetry grows with it, spanning cloud infrastructure, SaaS applications, endpoints, and identity systems. We’re looking for a Cybersecurity Senior Analyst to help build and operate a detection and response capability that is fast, high-fidelity, and increasingly automated.

In this role, you’ll be a cornerstone of our day-to-day security operations, treating detections as code, tuning our SIEM for signal over noise, partnering closely with our MDR provider, and automating response workflows so that human attention is reserved for the incidents that matter most. You’ll combine hands-on security operations with an engineering mindset, continuously finding ways to improve our detections, processes, and tooling as Thumbtack evolves.

While security operations will be your primary focus, you’ll also support the broader security program and flex into areas such as GRC, third-party risk, and vulnerability management as needed.

What you’ll do

• Own day-to-day security operations: monitoring, triage, and investigation of security alerts across our production, corporate, and SaaS environments.
• Manage and continuously improve our SIEM: log source onboarding, parsing and normalization, detection rule development and tuning, and cost/coverage optimization.
• Manage our MDR (Managed Detection & Response) partnership: escalation workflows, SLAs, detection feedback loops, and quality of response.
• Lead security incidents end-to-end: triage, scoping, containment, eradication, recovery, and blameless post-incident reviews.
• Build automation that reduces manual toil and response times: SOAR playbooks, detection-as-code pipelines, enrichment integrations, and response scripting.
• Conduct proactive threat hunting informed by threat intelligence and knowledge of Thumbtack’s environment.
• Define, track, and report on operational metrics (e.g. MTTD, MTTR, alert fidelity, coverage against ATT&CK) and use them to drive improvement.
• Apply AI tools to accelerate security operations, and continuously adapt our detections, processes, and tooling to address evolving and novel threats, including AI-related risks.
• Partner with Security Engineering, Platform, IT, and Compliance to close detection gaps and improve our overall security posture.
• Support the broader security program as needed: GRC (audit support, evidence collection, control monitoring), endpoint security, network security, third party risk reviews, vulnerability management (scanning, triage, and remediation coordination), etc.

In order to be successful, you must bring

• 6+ years of experience in security operations, detection & response, or a related security engineering discipline.
• Deep hands-on experience operating and tuning a SIEM, including detection engineering and log pipeline management.
• Experience managing or working closely with an MDR/MSSP partner, including escalation design and holding vendors accountable to quality and SLAs.
• Strong incident response skills across cloud-native environments (AWS and/or GCP), SaaS applications, endpoints, and identity systems.
• Fluency with AI tools in daily security work, and the adaptability to evolve detections, processes, and tooling to address novel and emerging threats, including AI-related risks.
• Scripting and automation proficiency (e.g. Python), with experience building SOAR playbooks, detection-as-code, or similar automation.
• Risk-based, analytical thinking: the judgment to prioritize what matters, tune out noise, and articulate trade-offs between coverage, fidelity, and effort.
• Working familiarity with adjacent security domains, including GRC and compliance frameworks (e.g. SOC 2, PCI DSS), third party risk assessment, and vulnerability management, with the flexibility to support them as needed.
• Excellent written and verbal communication skills, including clear incident communications, and the ability to collaborate effective with a distributed, primarily US-based team