Remote Cyber Defense Analyst

Remote Jobs; Atlanta (GA); Remote; USD 120,000 - 140,000; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

PTO & holidays

Sabbatical

Pet health insurance

Volunteer time off

Seattle office perks

Job summary

Trupanion is seeking a Cybersecurity Analyst to support day-to-day Security Operations and Incident Response, monitor threats, coordinate incident response, and drive threat intelligence and hunting. The role covers vulnerability workflows, case management, and collaboration with Security Engineering on platform remediation.

The position is remote for US-based candidates (EST) with Seattle-area hybrid options.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS, Digital Forensics, or related field, or equivalent practical experience.
• 3+ years of experience in cybersecurity operations, incident response, IT operations, system administration, network security, or a related area.
• Experience investigating alerts using SIEM, EDR/XDR, identity, email, cloud, network, or vulnerability technologies.
• Knowledge of attacker techniques, phishing, malware, account compromise, privilege misuse, lateral movement, exfiltration, and vulnerability exploitation.
• Experience applying threat intelligence and incident telemetry to vulnerability prioritization and exploitation assessment.
• Experience with security automation or scripting, digital-evidence handling, identity investigations, third-party incident analysis, and structured case management.

Responsibilities

• Monitor and triage alerts across identity, endpoint, email, network, cloud, application, vulnerability, and data-protection technologies.
• Validate, enrich, classify, and prioritize security events and investigate phishing, account compromise, malware, ransomware, unauthorized access, data exposure, insider threat, and third-party events.
• Execute approved containment actions within assigned permissions and coordinate infrastructure-level or production changes with Technology Operations.
• Collect and preserve evidence, identify affected users, devices, accounts, systems, repositories, and data, and support eradication, recovery validation, heightened monitoring, and closure.
• Collect and evaluate intelligence from commercial, government, industry, open-source, MDR, vendor, and internal sources.
• Analyze threat actors, campaigns, tactics, techniques, procedures, indicators, exploited vulnerabilities, and targeted technologies for relevance to Trupanion.
• Create tactical and operational intelligence products and operationalize findings through investigations, detections, hunting queries, watchlists, blocking actions, phishing simulation scenarios, and runbook updates.
• Conduct hypothesis-driven hunts across identity, endpoint, email, network, cloud, and application telemetry using MITRE ATT&CK and document scope, queries, evidence, findings, and follow-up actions.
• Validate vulnerability findings, assess risk and business exposure, prioritize remediation using threat intelligence and incident telemetry, identify indications of exploitation, and elevate urgent vulnerabilities.
• Perform threat hunts against affected technologies and recommend temporary containment or monitoring when active exploitation or incident correlation is identified.
• Partner with Security Engineering, which owns vulnerability-scanning platforms, integrations, technical configuration, and platform reliability.
• Coordinate remediation assignments with technology and application owners, maintain the vulnerability ticket flow, track progress against defined service levels, report overdue exposure, and escalation ownership or delivery issues through the established governance process.
• Maintain operational oversight of vulnerability validation, prioritization, ticketing, remediation follow-up, SLA reporting, and escalation; remediation execution remains with the technology or application owner responsible for the affected asset or service.
• Develop and maintain approved automation workflows, scripts, and playbooks for alert enrichment, investigation, authorized response, and case consistency.
• Preserve identity, endpoint, email, cloud, network, application, and audit-log evidence under approved forensic, legal-hold, integrity, and chain-of-custody procedures.
• Maintain complete case records covering severity, affected assets, evidence, analysis, actions, decisions, communications, and closure rationale.
• Validate incident containment and corrective actions through available telemetry, testing, or monitoring.
• Support breach investigations by identifying affected repositories, records, data types, individuals, business entities, and jurisdictions for Legal and Privacy review.
• Investigate token theft, MFA changes, privilege escalation, malicious application consent, mailbox manipulation, and compromised user, privileged, service-principal, or workload identities.
• Investigate third-party, supply-chain, and AI-related security notifications or suspected misuse and document potential Trupanion exposure.

Skills

Defender/Microsoft Defender

Microsoft Sentinel

Microsoft 365

Azure

Identity security

Privileged access management

Cloud security

Endpoint security

MITRE ATT&CK

Incident response

Education

Bachelor's degree in Cybersecurity or related field

Job description

Trupanion is seeking a Cybersecurity Analyst to support day-to-day Security Operations and Incident Response, monitor threats, coordinate incident response, and drive threat intelligence and hunting. The role covers vulnerability workflows, case management, and collaboration with Security Engineering on platform remediation.

The position is remote for US-based candidates (EST) with Seattle-area hybrid options.