Principal Threat Detection & Response Analyst - Remote

Amtrak; United States; Remote; USD 125,000 - 161,000; Full time

Job summary

Amtrak is seeking a Principal Threat Detection & Response Analyst to join the Cyber Fusion Center. You will lead incident response operations, perform digital forensics, and coordinate with cross-functional teams to quickly detect, contain, and remediate cybersecurity incidents across IT and OT domains.

The role emphasizes building playbooks, participating in tabletop exercises, and advancing threat detection capabilities, with flexibility for 100% remote, on-site, or hybrid work arrangements.

Qualifications

• Bachelor’s degree in computer science, Information Systems, Cybersecurity, or related technical field plus 7+ years of relevant experience.
• Experience on one or the combination of the below to satisfy education and experience requirements: Incident Response, Vulnerability Management, Digital Forensics, Network or Cloud Security, Penetration Testing.

Responsibilities

• Provide incident response support to effectively detect and respond to threats and reduce business risk.
• Navigate critical incidents with digital forensic and incident response analysis with support from threat hunting and malware triage analysts.
• Support Amtrak-wide cyber incident response engagements across cloud, endpoint, and network evidence sources.
• Develop, refine, and maintain playbooks, policies, and procedures aligned to industry best practices.

Skills

SIEM

EDR

Threat intel

Malware analysis

MITRE ATT&CK

Log analysis

Forensics tools

PowerShell

Python

Threat hunting

Education

Bachelor's degree in computer science/Information Systems/Cybersecurity

Tools

Threat intelligence platforms

Log analysis tools

Job description

Amtrak is seeking a Principal Threat Detection & Response Analyst to join the Cyber Fusion Center. You will lead incident response operations, perform digital forensics, and coordinate with cross-functional teams to quickly detect, contain, and remediate cybersecurity incidents across IT and OT domains.

The role emphasizes building playbooks, participating in tabletop exercises, and advancing threat detection capabilities, with flexibility for 100% remote, on-site, or hybrid work arrangements.