Lead AI-Driven Security Operations Analyst (MSSP)

OpenKrill; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Wursta is seeking a Lead Security Operations Analyst to drive real-time threat monitoring, incident response, and SLA delivery across client tenants in a Secure AI Augmented SOC environment.

The role combines security operations leadership with AI integration engineering, leveraging tools like Gemini and Claude APIs to create automated escalation and detection workflows in a fast, automation-first MSSP platform.

Qualifications

• Experience with SIEM/XDR platforms such as Splunk, SentinelOne, and CrowdStrike.
• Proficiency in cloud security architectures across AWS, Azure, and GCP.
• Ability to develop automation scripts in Python, REST APIs, and related tooling.
• Familiarity with MITRE ATT&CK, NIST CSF, YARA, Sigma rules, and incident response playbooks.

Responsibilities

• Lead real-time threat monitoring, incident response, and SLA delivery for multiple tenant environments.
• Serve as Incident Commander during critical security events with standard frameworks (NIST SP 800-61r2).
• Design and implement AI-driven detection, automation, and escalation workflows in the MSSP platform.
• Develop integrations to monitor additional security telemetry and third-party tools.
• Ensure compliant, audit-ready security operations across multi-tenant architecture.

Skills

SIEM & XDR

Threat Hunting

Incident Response

Python/Automation

APIs & Integrations

Cloud Security

Tools

Splunk

Microsoft Sentinel

Elastic SIEM

CrowdStrike

SentinelOne

Cortex XDR

Wireshark

Zeek

Suricata

PCAP Analysis

Syslog

CloudTrail/CloudWatch

Python

REST APIs

Docker

Cortex XSOAR

GitHub Copilot

LangChain

Webhooks

Job description

Wursta is seeking a Lead Security Operations Analyst to drive real-time threat monitoring, incident response, and SLA delivery across client tenants in a Secure AI Augmented SOC environment.

The role combines security operations leadership with AI integration engineering, leveraging tools like Gemini and Claude APIs to create automated escalation and detection workflows in a fast, automation-first MSSP platform.