Cyber Defense Analyst – Level 2 / Level 3

StepChange; Houston (TX); Hybrid; USD 90,000 - 130,000; Full time

Job summary

StepChange seeks Cyber Defense Analysts (Level 2 and Level 3) to join a global cybersecurity operations team in Houston, TX. These hands-on roles focus on monitoring, investigation, and response to security threats across enterprise environments.

Level 2 emphasizes foundational SOC skills and expanding capabilities; Level 3 requires leadership of complex investigations and advanced threat analysis. Hybrid work in Houston with requirements to work across time zones.

Qualifications

• Experience in Security Operations, threat detection, and incident response.
• Level 2 requires foundational cybersecurity experience; Level 3 requires advanced investigation and incident handling.
• Familiarity with MITRE ATT&CK and enterprise security operations is valued.

Responsibilities

• Monitor and investigate security alerts using SIEM, EDR, and related monitoring tools.
• Triage alerts, assess severity, and investigate activity across endpoints, identity, cloud, and network.
• Follow incident response procedures, document investigations, and hand over cases.
• Collaborate with senior analysts and other cybersecurity teams.
• Level 3: independently lead complex investigations and coordinate containment and escalation.

Skills

SOC experience

Threat detection

Security investigations

Incident response

Tools

Microsoft Sentinel

Microsoft Defender

SIEM

EDR

Job description

StepChange is seeking Cyber Defense Analysts (Level 2 and Level 3) for multiple opportunities supporting an established global cybersecurity operations team within a complex enterprise environment.

We are looking for cybersecurity professionals with experience in Security Operations (SOC), threat detection, security investigations, and incident response.

These are hands-on technical roles for people who are experienced in investigating security threats, taking ownership of their work, and contributing to the continued development of Cyber Defense capabilities.

We are considering candidates at both levels, with placement determined by experience, technical capability, and assessment.

Anticipated start: January 2027, with opportunities to begin earlier.

About StepChange

Houston, TX | Hybrid

StepChange is seeking Cyber Defense Analysts (Level 2 and Level 3) for multiple opportunities supporting an established global cybersecurity operations team within a complex enterprise environment.

We are looking for cybersecurity professionals with experience in Security Operations (SOC), threat detection, security investigations, and incident response.

These are hands-on technical roles for people who are experienced in investigating security threats, taking ownership of their work, and contributing to the continued development of Cyber Defense capabilities.

We are considering candidates at both levels, with placement determined by experience, technical capability, and assessment.

Anticipated start: January 2027, with opportunities to begin earlier.

About StepChange

StepChange is an ASX-listed company with more than 20 years of experience supporting major organizations across energy, resources, and other complex industries.

Our longstanding client relationships and growing demand for our capabilities led us to establish a presence in Houston.

We bring experienced advisors, practitioners, and technical specialists alongside our clients to support complex Digital, Technology, Strategy, and Change initiatives.

The Opportunity

You will join a global Cyber Defense operation responsible for monitoring, investigating, and responding to cybersecurity threats across enterprise technology environments.

Alongside day-to-day Security Operations, there are opportunities to contribute to:

• Advanced threat hunting and threat intelligence
• Vulnerability management and threat assurance
• Detection engineering and continuous improvement
• Incident response procedures, playbooks, and automation

What You'll Do

Level 2 - Cyber Defense Analyst

• Monitor and investigate security alerts using SIEM, EDR, and security monitoring tools.
• Perform alert triage, assess severity, and investigate suspicious activity across endpoint, identity, cloud, and network environments.
• Follow established incident response procedures and escalation protocols.
• Maintain accurate investigation records, case documentation, and operational handovers.
• Support alert enrichment, IOC analysis, and detection improvements.
• Collaborate with senior analysts and broader cybersecurity teams.

Level 3 - Cyber Defense Analyst

In addition to core Security Operations responsibilities, Level 3 analysts will:

• Independently lead complex security investigations and high-severity incident response activities.
• Perform advanced analysis across SIEM, EDR, DNS, identity, and other telemetry sources.
• Apply threat hunting methodologies and the MITRE ATT&CK framework to investigate adversary activity.
• Coordinate incident containment, technical escalation, and response activities across teams.
• Identify detection gaps and improve monitoring, response playbooks, and automation.
• Mentor junior analysts, provide technical guidance, and communicate findings to cybersecurity leadership.

What You Bring

Level 2

For Level 2, we're looking for analysts with foundational cybersecurity experience who are ready to further develop their Security Operations capabilities:

• Foundational knowledge of security operations, threat detection, and incident response.
• Experience with or exposure to SIEM and EDR platforms, particularly Microsoft Sentinel and Defender.
• Understanding of security alert investigation, escalation, and documentation.
• Strong analytical skills, attention to detail, and a willingness to develop technical capabilities.
• Ability to work effectively in a collaborative, globally distributed team.

Level 3

We are looking for experienced practitioners who bring:

• Typically 5-10 years of experience in Security Operations or Incident Response.
• Demonstrated experience independently leading complex investigations and incident response.
• Advanced understanding of attacker tactics, techniques, and procedures.
• Practical experience in threat hunting, incident containment, and detection improvement.
• Strong technical judgment, communication skills, and experience mentoring other analysts.
• Familiarity with major incident management, MITRE ATT&CK, and enterprise security operations.

Experience with Microsoft security technologies, SOAR, threat intelligence, and response automation is highly valued.

Working Arrangements

• Location: Houston, Texas, with a current hybrid arrangement of three days onsite and two days remote.
• Global collaboration: Occasional evening meetings across international time zones.
• Security operations coverage: Participation in rotating weekend and holiday coverage, currently approximately once every 3-5 weeks, including alert monitoring and incident response when required.
• Work authorization: Candidates must already be authorized to work in the United States. Sponsorship is not available.

Working arrangements and coverage requirements may change based on operational needs. Further details will be discussed during the selection process.

Why StepChange?

You’ll have the opportunity to contribute to an established global cybersecurity operation, work alongside experienced technical professionals, and broaden your capabilities across incident response, threat intelligence, detection engineering, and security operations.

We value people who take ownership, exercise sound technical judgment, collaborate effectively, and are committed to developing their expertise.

Shortlisted candidates will participate in a technical assessment and interview process.

Take the Step.

www.stepchange.com.au