Security Analyst III

Recru; Houston (TX); On-site; USD 120,000 - 160,000; Full time

Job summary

Recru in Houston seeks a senior Security Analyst III to lead high-severity investigations and drive end-to-end response from detection to containment and recovery.

The role requires hands-on DFIR, malware analysis, evidence handling, and mentoring within a 24/7 environment. Strong communication skills and the ability to present complex findings to leadership are essential.

Qualifications

• 8+ years of cybersecurity experience in Security Operations, Incident Response, or DFIR.
• Experience owning major cybersecurity incidents end-to-end.
• Hands-on DFIR activities including evidence preservation and chain of custody.
• Experience analyst in Windows environments, networks, and enterprise systems.
• Proficient in SIEM/EDR/XDR tooling and threat intelligence.

Responsibilities

• Lead hands-on investigation and response for complex incidents.
• Perform digital forensics analysis of endpoints and artifacts.
• Analyze malware and reverse engineer to determine IOC and impact.
• Preserve evidence with chain-of-custody throughout investigations.
• Drive containment, eradication, recovery, and root-cause analysis.
• Coordinate major incident response across security and infrastructure teams.
• Conduct advanced threat hunting using SIEM/EDR/telemetry.
• Tune SIEM detections and dashboards for better detection.
• Present findings to technical and leadership stakeholders.
• Create incident response playbooks and data flows.

Skills

Cybersecurity

Security Operations

Incident Response

DFIR

Digital Forensics

Malware Analysis

Threat Hunting

SIEM

EDR/XDR

Mentoring

Communication

Tools

Splunk

Microsoft Sentinel

Job description

Work Authorization: This position requires candidates to be U.S. citizens or U.S. lawful permanent residents (Green Card holders).

Overview

The Security Analyst III serves as a senior, hands-on technical resource within Security Operations, responsible for advanced threat investigation, digital forensics, malware analysis, and end-to-end incident response. This individual will take ownership of complex and high-severity security incidents, driving investigations from initial detection through containment, eradication, recovery, and root-cause analysis.

This role requires deep technical expertise in digital forensics and incident response (DFIR), including malware analysis/reverse engineering, evidence preservation, and maintaining chain of custody during investigations. The Security Analyst III also serves as an escalation point and mentor within the SOC and supports a 24/7/365 global environment through an on-call rotation.

Key Responsibilities

• Lead hands-on investigation and response for complex and high-severity cybersecurity incidents.
• Perform digital forensic analysis of compromised endpoints, systems, files, and other artifacts to determine attack vectors, scope, root cause, and impact.
• Perform malware analysis and reverse engineering to understand malicious behavior, indicators of compromise (IOCs), persistence techniques, and potential impact.
• Collect, preserve, document, and handle forensic evidence while maintaining chain of custody throughout investigations.
• Drive incidents through containment, eradication, recovery, and root-cause analysis, taking direct technical action when necessary rather than simply escalating incidents.
• Support and/or run major incident response, coordinating technical investigation and remediation activities across security and infrastructure teams.
• Perform advanced threat hunting and investigation using SIEM, EDR/XDR, threat intelligence, network data, and other security telemetry.
• Tune and optimize SIEM detections, alerts, dashboards, and security tooling to improve detection accuracy and response capabilities.
• Present findings from threat analysis, forensic investigations, and major incidents to technical and non-technical stakeholders.
• Create and maintain incident response procedures, investigation documentation, playbooks, data flows, and technical diagrams.
• Support cybersecurity system upgrades, new SOC technologies, Disaster Recovery planning, and change management.
• Act as a senior escalation point and mentor to junior SOC/security analysts.
• Drive continuous improvement across security tools, incident response processes, and detection capabilities.

Required Skills & Experience

• 8+ years of cybersecurity experience, with significant hands-on experience in Security Operations, Incident Response, or DFIR.
• Demonstrated experience owning major cybersecurity incidents from detection/investigation through containment, eradication, recovery, and root-cause analysis.
• Hands‑on digital forensics experience, including acquisition and analysis of system/endpoint artifacts and preservation of forensic evidence.
• Hands‑on malware analysis experience, including the ability to analyze and reverse engineer malicious files/code to determine behavior and indicators of compromise.
• Strong understanding of forensic evidence handling and chain-of-custody requirements.
• Experience investigating compromised Windows environments, endpoints, networks, and enterprise systems.
• Advanced threat detection, threat hunting, forensic investigation, and threat intelligence capabilities.
• Hands‑on experience with SIEM and security monitoring platforms such as Splunk and Microsoft Sentinel, as well as EDR/XDR technologies.
• Ability to independently investigate complex incidents, determine appropriate containment actions, and drive incidents toward resolution.
• Experience serving as a senior SOC escalation point and mentoring less‑experienced analysts.
• Strong written and verbal communication skills, including presenting complex incident findings to technical teams and leadership.