MDR Analyst

SkyeBiz; Washington (District of Columbia); Remote; USD 105,000 - 120,000; Full time

Job summary

SkyeBiz is seeking a Senior MDR Analyst to join our growing US MDR capability. This fully remote, permanent role targets West Coast business hours and requires an experienced analyst who can own complex security incidents from day one.

You will independently investigate, contain, and document incidents, act as escalation for US customers, and improve threat detection and playbooks while helping establish standards for the new SOC.

Qualifications

• Extensive MDR/SOC experience with independent ownership of complex incidents.
• Expertise with EDR/XDR and SIEM tools.
• Strong Windows Sysmon and PowerShell analysis.
• Threat hunting and detection engineering experience.
• Proficient in security incident reporting and customer communication.

Responsibilities

• End-to-end ownership of incident response, including triage, investigation, containment, remediation, customer communication, and post-incident reviews.
• Advanced analysis of EDR/XDR and SIEM alerts, Windows, Sysmon, identity, email, cloud, and network telemetry.
• Threat hunting and detection engineering aligned to MITRE ATT&CK.
• Writing and tuning detection logic and security monitoring content.
• Leading customer-facing discussions and producing executive and technical reports.
• Supporting onboarding activities and validating monitoring coverage.
• Mentoring junior analysts and improving SOC processes.

Skills

MDR/SOC ops

Incident response

Threat hunting

Automation / SOAR

Customer communication

Security reporting

PowerShell

Cloud security (Azure/AWS)

Tools

CrowdStrike

Microsoft Defender

SentinelOne

Microsoft Sentinel

QRadar

Splunk

Chronicle

Job description

This role is only open to USA Citizens working on the West Coast of America

USA Westcoast | Remote | $105k to $120k per annum | Permanent

The role is a Senior MDR Analyst position within a newly developing US Security Operations Centre capability. It is a fully remote, permanent US-based role operating during West Coast business hours, intended for a highly experienced analyst who can work independently and take ownership of complex security incidents from day one.
The successful candidate will independently investigate, contain, and document complex cyber security incidents. Act as a trusted technical escalation point for US customers. Improve threat detection, response processes, and operational playbooks. Help establish standards and practices for the growing US MDR service.

Core Responsibilities

• End-to-end ownership of incident response, including triage, investigation, containment, remediation, customer communication, and post-incident reviews.
• Advanced analysis of:
  • EDR/XDR and SIEM alerts
  • Windows, Sysmon, identity, email, cloud, and network telemetry
  • PowerShell, persistence mechanisms, credential theft, lateral movement, command-and-control activity, and data exfiltration.
• Threat hunting and detection engineering aligned to MITRE ATT&CK.
• Writing and tuning detection logic and security monitoring content.
• Leading customer-facing discussions and producing executive and technical reports.
• Supporting onboarding activities and validating monitoring coverage.
• Mentoring junior analysts and improving SOC processes.

Technical Requirements

Candidates must demonstrate:

• Significant MDR, MSSP, or mature SOC experience with independent ownership of complex incidents.
• Strong EDR/XDR expertise (e.g. CrowdStrike, Microsoft Defender, SentinelOne).
• Advanced SIEM investigation skills (e.g. Microsoft Sentinel, QRadar, Splunk, Chronicle).
• Windows investigation expertise, including Sysmon and PowerShell analysis.
• Network investigation capability using DNS, firewalls, IDS/IPS, packet captures, Wireshark, Zeek, Snort, or similar tools.
• Email security investigation experience.
• Threat hunting and detection engineering expertise.
• Malware triage and sandbox analysis.
• Automation or scripting experience using Python, PowerShell, or SOAR platforms.
• Excellent customer communication and technical writing skills.

Preferred Background

• Helped launch or scale an MDR/SOC service.
• Worked as a senior technical SME in a distributed team.
• Experience investigating Azure/Entra ID and AWS or Google Cloud environments.
• Exposure to Chronicle SOAR or similar orchestration platforms.
• Certifications such as SC-200, BTL1/BTL2, CySA+, GCIH, GCIA, OSCP, or CISSP.

Ideal Candidate Profile

In practical terms, this role is targeting a senior MDR/SOC professional who can independently lead investigations, communicate directly with customers, conduct threat hunting, build detections, automate workflows, and help shape a new US MDR operation, rather than a traditional analyst focused primarily on monitoring alerts and escalating incidents.